Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe
Resource
win7-20240704-en
General
-
Target
21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe
-
Size
2.8MB
-
MD5
993f5fdf3bd55f35661293167e39649a
-
SHA1
4dca34fd078faf357dbfb56181e2dbbaca2ae9d6
-
SHA256
21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add
-
SHA512
04894447773cccabaeeb7c05599eab586376f54d3a9a482f21b3fa79b969e969e29bf5f2c55a36e4bdd433f763ed97926a632cd6b7d6ceead0ee75684b975f59
-
SSDEEP
49152:+qaUDr+obxLq3iaBwdxiMaxx1buynNoTugnzq3bZvTFTSXedTUDoCFRbH:1i3x13n+TuKz8bZv8XedyouRbH
Malware Config
Extracted
stealc
default
http://193.176.190.41
-
url_path
/2fa883eebd632382.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2388 set thread context of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 -
Program crash 1 IoCs
pid pid_target Process procid_target 2912 2196 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 PID 2388 wrote to memory of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 PID 2388 wrote to memory of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 PID 2388 wrote to memory of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 PID 2388 wrote to memory of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 PID 2388 wrote to memory of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 PID 2388 wrote to memory of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 PID 2388 wrote to memory of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 PID 2388 wrote to memory of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 PID 2388 wrote to memory of 2196 2388 21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe 29 PID 2196 wrote to memory of 2912 2196 MSBuild.exe 30 PID 2196 wrote to memory of 2912 2196 MSBuild.exe 30 PID 2196 wrote to memory of 2912 2196 MSBuild.exe 30 PID 2196 wrote to memory of 2912 2196 MSBuild.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe"C:\Users\Admin\AppData\Local\Temp\21381b405bbb2d1ac38f1d908e0dc8a399fb2401d2ed1c1a300a2144626f9add.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 443⤵
- Program crash
PID:2912
-
-