Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 02:51
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
file.exe
-
Size
896KB
-
MD5
f3e9e7e299b3f0cc7af5b93451f8a6b8
-
SHA1
737f2da571a2905d1843b2377aff25307b90c404
-
SHA256
3dadcf5a61d297a2c61a690f7893297d2197bd6ab9ab87e7583bcbec66a8cc55
-
SHA512
0de88e5720b9541b967cc81b03fd14a3cd1eebf6cdca2449cb00d32c0e1fef9b37c465c073339b6dd4af3634fd6570e3ad4a517f45910e9f7952e85603547d82
-
SSDEEP
12288:UqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTO:UqDEvCTbMWu7rQYlBQcBiT6rprG8asO
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe 2392 file.exe