Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
28792fdb6feadd7d3758cb15c4cd36b0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
28792fdb6feadd7d3758cb15c4cd36b0N.exe
Resource
win10v2004-20240802-en
General
-
Target
28792fdb6feadd7d3758cb15c4cd36b0N.exe
-
Size
75KB
-
MD5
28792fdb6feadd7d3758cb15c4cd36b0
-
SHA1
188eb349bd9677dbf0481318e2ce7f2ca2258460
-
SHA256
0e78858c50e5863eb043d875c74d6c8854b9d3149c207b01ccff75fcec740742
-
SHA512
0587797ea858f59318b622387ee7762f53b815c72466a82c154f777f986576896c7e1a83338df83720124d85b346d5f499967a921cfffa169b855132c36f7385
-
SSDEEP
1536:sx1Qjx7luw7JTjeFJVscGOCctkiGRS73C12i0bzaR:EOjruwljeFJVBGORui4PR
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4100 872 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28792fdb6feadd7d3758cb15c4cd36b0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28792fdb6feadd7d3758cb15c4cd36b0N.exe"C:\Users\Admin\AppData\Local\Temp\28792fdb6feadd7d3758cb15c4cd36b0N.exe"1⤵
- System Location Discovery: System Language Discovery
PID:872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 872 -s 2322⤵
- Program crash
PID:4100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 872 -ip 8721⤵PID:1984