Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 02:35
Behavioral task
behavioral1
Sample
PHISHING EMAIL SCAM ALERT - Midea 2024.pdf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
PHISHING EMAIL SCAM ALERT - Midea 2024.pdf
Resource
win10v2004-20240802-en
General
-
Target
PHISHING EMAIL SCAM ALERT - Midea 2024.pdf
-
Size
389KB
-
MD5
00cd3cf63c441547a5db94f99b53087a
-
SHA1
e8f679f644a53773adedb049a7d5f6024b3b52c8
-
SHA256
a1ab2444e344b62b37054748a0b1355f0c5e48bd710f2628ebaedcb178292970
-
SHA512
b45dda676009257eb3f97ea3773fa3921869b7438e7aabee72bac236f3d6dfa2efc5cde5f0ecfb2a9c23576d2dd9304b5f0c16f3e32050b4c9309f05ed3036f2
-
SSDEEP
12288:edMznsHW8PsYHZtcBJmRgl5h60xs+FGyG5rez:edQ2yJugZ6nF3sz
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2076 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2076 AcroRd32.exe 2076 AcroRd32.exe 2076 AcroRd32.exe 2076 AcroRd32.exe 2076 AcroRd32.exe 2076 AcroRd32.exe 2076 AcroRd32.exe 2076 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PHISHING EMAIL SCAM ALERT - Midea 2024.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
389KB
MD500cd3cf63c441547a5db94f99b53087a
SHA1e8f679f644a53773adedb049a7d5f6024b3b52c8
SHA256a1ab2444e344b62b37054748a0b1355f0c5e48bd710f2628ebaedcb178292970
SHA512b45dda676009257eb3f97ea3773fa3921869b7438e7aabee72bac236f3d6dfa2efc5cde5f0ecfb2a9c23576d2dd9304b5f0c16f3e32050b4c9309f05ed3036f2
-
Filesize
5KB
MD54618312ec50b52c81043bb6ff393cfc3
SHA180537497d939529b34de993b14d96510068bf075
SHA256e8e27396e2a043abd283eed4fd5b8fa256cc22e741defd522158fc9e29205839
SHA512fc589a974f35ee83c297784c7d7cc62826854422ceec2d5ff46aa6575f5b2bade27d26c1dfc0686602c81e5c14f75f7abd23e6c19fd90a2dbe70e0f5c09251e9
-
Filesize
3KB
MD53eaefd1ea16626174cad33b68f5d5370
SHA1c33fb47da60505270a0824b4df5fbebbe2c14e7e
SHA25637641150543ce0d29aeb3bed6e0e17b47be1240a782f4a0af724cb4ea62ae1db
SHA5126a2efa9feef124a1347ca54087a742f8210d326d672dced3ce34f4be2c45bf8b986d24a9f7c785d471a3d82f20461b181971142c546b39a2ca499e95697e2803