Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
f6263f931a409c843b864cee598d20f0N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f6263f931a409c843b864cee598d20f0N.exe
Resource
win10v2004-20240802-en
General
-
Target
f6263f931a409c843b864cee598d20f0N.exe
-
Size
184KB
-
MD5
f6263f931a409c843b864cee598d20f0
-
SHA1
dab6cc78bc49e88079aea19803521543e1492016
-
SHA256
4f75a80f49f619ad4fc6ffae3e8c154c24f7c245eaa709ddd5f56ed4505166d7
-
SHA512
edd3dea7da652215f5d22199be0a24b4da612744f8774078677a8f37e4ddb9ffb6b2d63d0793f17034a8d58f6bb7baa222f37fcc97c51f7bd7926645e27ab2ec
-
SSDEEP
3072:+1m6BpoO+zY6ZcXtKbPh8/VzFlvnqgxiu9n3:+1ToiCcX28tzFlPqgxiu9
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2236 2716 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6263f931a409c843b864cee598d20f0N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2716 f6263f931a409c843b864cee598d20f0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2236 2716 f6263f931a409c843b864cee598d20f0N.exe 30 PID 2716 wrote to memory of 2236 2716 f6263f931a409c843b864cee598d20f0N.exe 30 PID 2716 wrote to memory of 2236 2716 f6263f931a409c843b864cee598d20f0N.exe 30 PID 2716 wrote to memory of 2236 2716 f6263f931a409c843b864cee598d20f0N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6263f931a409c843b864cee598d20f0N.exe"C:\Users\Admin\AppData\Local\Temp\f6263f931a409c843b864cee598d20f0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 2362⤵
- Program crash
PID:2236
-