Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 09:27
Static task
static1
Behavioral task
behavioral1
Sample
35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe
Resource
win10v2004-20240802-en
General
-
Target
35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe
-
Size
1.3MB
-
MD5
718620e0c14d32edbc0c41085eda3072
-
SHA1
27f4a1a1315611df12965c62f8eddb781ef2b72d
-
SHA256
35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711
-
SHA512
e61fadfe72b00c132bde31a04e03af5b7899c6a9c528f2838a83a54faebd0358625787b8fda61cdf334462ecf3bd42b7a4a3b442ec8aedb977ec96a030ab7ce2
-
SSDEEP
24576:tqDEvCTbMWu7rQYlBQcBiT6rprG8au9eZOr0jvtZ4HpsZw:tTvC/MTQYxsWR7aussrTyZ
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3204 set thread context of 1716 3204 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe 87 -
Program crash 1 IoCs
pid pid_target Process procid_target 4644 3204 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe 1716 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3204 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3204 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe 3204 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3204 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe 3204 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3204 wrote to memory of 1716 3204 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe 87 PID 3204 wrote to memory of 1716 3204 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe 87 PID 3204 wrote to memory of 1716 3204 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe 87 PID 3204 wrote to memory of 1716 3204 35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe"C:\Users\Admin\AppData\Local\Temp\35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\35aad958ea02458da32208308f06b03c43d414108eb36ecb9f030df395797711.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 7242⤵
- Program crash
PID:4644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3204 -ip 32041⤵PID:8
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD509fe37a4e5b10dcd3d6642951a8e87ce
SHA16ed7bbcac2de080eb2bfd879293ffd654da1e36e
SHA256da22ee125cb66c1537b42be1eacd6fec19b59379b58537c0cdc77162012b0da6
SHA5128fe3619a43ee04f390123c80fcd8a2de939b89b223969ea41eb79c191581a19f2e3ac763d40037cbe2d9778b3289fd62ae0f7a9fcf9cafd97fc196c58627608e