Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 00:39
Static task
static1
Behavioral task
behavioral1
Sample
833b4638966d6adcbcac849646612cd0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
833b4638966d6adcbcac849646612cd0N.exe
Resource
win10v2004-20240802-en
General
-
Target
833b4638966d6adcbcac849646612cd0N.exe
-
Size
256KB
-
MD5
833b4638966d6adcbcac849646612cd0
-
SHA1
b144886ae5af71a6f199184ad28e941a6e547b4b
-
SHA256
80d2e98b76197bb1f1f0f4174c2ca0542118a0fe0e7d84d2dbee6bc9e2ecb418
-
SHA512
9defd53ce764e53b080bcf2f935d81ab5a2fe7f7b3bbbc334cb7da71b1256a32b4544ca984528245a1b076e926c21a91655d705e40b4f5ba60b861bef5ed213f
-
SSDEEP
6144:XL9wq8PSwM4Qf8Nt/8JGOMIP8mcenRv27NSJBpNeAsLl2k/JrAV400:79wq8qwMnf8Nt/8IOMIP8mcenRv27NSS
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2952 833b4638966d6adcbcac849646612cd0N.exe -
Executes dropped EXE 1 IoCs
pid Process 2952 833b4638966d6adcbcac849646612cd0N.exe -
Loads dropped DLL 1 IoCs
pid Process 3004 833b4638966d6adcbcac849646612cd0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 833b4638966d6adcbcac849646612cd0N.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3004 833b4638966d6adcbcac849646612cd0N.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2952 833b4638966d6adcbcac849646612cd0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2952 3004 833b4638966d6adcbcac849646612cd0N.exe 30 PID 3004 wrote to memory of 2952 3004 833b4638966d6adcbcac849646612cd0N.exe 30 PID 3004 wrote to memory of 2952 3004 833b4638966d6adcbcac849646612cd0N.exe 30 PID 3004 wrote to memory of 2952 3004 833b4638966d6adcbcac849646612cd0N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\833b4638966d6adcbcac849646612cd0N.exe"C:\Users\Admin\AppData\Local\Temp\833b4638966d6adcbcac849646612cd0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\833b4638966d6adcbcac849646612cd0N.exeC:\Users\Admin\AppData\Local\Temp\833b4638966d6adcbcac849646612cd0N.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5f36385b0c69b04eab0e702f68fd82ed1
SHA1ff8e0f3bc92d6425df55e969fdcc3685f1d273a6
SHA2560fa77e17b6335bebc5ad69c59eadd947bea7590a1d82d3a8059256f265c5d5db
SHA512af8bcb61f9d8a36c05f1f782bd826bb7cd58f789d54f6fa7f16d5b44eb70d188208969729bb0f9533108602c6a4c320a78baf2c06248ff29ea09f65475bce289