Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe
Resource
win10v2004-20240802-en
General
-
Target
9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe
-
Size
10.8MB
-
MD5
28e2f9388087d25ab73c757995eeb210
-
SHA1
4580981f2f3e83bf1461b66e59e9709637425894
-
SHA256
9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed
-
SHA512
1665c3a19ba1527732860e1c1bae1d158aed035c75ae7638bad6369cb8d92c2595620b4b087dd3ba62cc7f0b53ef25b3b37ae4f4c5f830807d71efb4577d691d
-
SSDEEP
196608:ylWW9DrFSSJ7PbDdh0HtQba8z1sjzkAilU4I4:ylWO5J7PbDjOQba8psjzyz
Malware Config
Signatures
-
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 1596 9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe 1596 9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1596 9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe"C:\Users\Admin\AppData\Local\Temp\9b947fff693de5244351cc56d40582c60a502aba674e7e5aa14023b7a9cc99ed.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD57ed3f2c35532c46e6af756850c0e3983
SHA163973df61d0c065fbbb20c74f321a9edcbf08c18
SHA2562cfc64c906ab356d65918444f6bbcab3920b21c91ce00d1d0d370dabe2c395cd
SHA512388148e366a2a8bbdc14ff534126ee7bd49e4c222cb71157d19746547fd0208cb0d0db4e05289ba6ecfab7c89d278ba4735a933cb27e198e9d2b1af247967cac
-
Filesize
9KB
MD5baff449b7daf536e0ae4a8274353209b
SHA10402076a951353e6600b7a0897b4c720eb4027a3
SHA256db2305c939dbe42df371f1550e08f4b848d28d957817586fba395556a8e24e9c
SHA512a477a9ee334424281dd104748392c04cdb902d4de1e3901cac15de94d8291fe6d5f1a5f38582a9083fea8ee0811e8d87595780bd50733dc169d8bd2cbe6ad5a2
-
Filesize
38B
MD59c2c69011ea7c696ba8774c6d62cdfcc
SHA17d1661f5966adb0cb635e653de32b6788927c4d0
SHA256ee0fde10a12c531788e7fd2e29f86f12f9db67b8da6ad0969a9ca51c0e48dc3b
SHA512f59d326b7bef57a0b0704680fc10a56c66483a0fe48c1155e199859e71c75b9692d2014c0500041d49798ce5e6062443e42fc2ca7ce1f0467b0f39085baa37aa