Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 06:21
Static task
static1
Behavioral task
behavioral1
Sample
NEW PO.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
NEW PO.exe
Resource
win10v2004-20240802-en
General
-
Target
NEW PO.exe
-
Size
485KB
-
MD5
e613adb29d8959c744e552ffd14f0785
-
SHA1
f99bd268a72a2d2c7eb6694529bda9f36756642a
-
SHA256
b091a27264aa6afd6e0215401398c062071b6d0f4924494202486bb7cd60a6d1
-
SHA512
f39b42820fa13f0465ccf54f24cfa16a40be20faf565454eb00efde6f91e1a09c636d3017fd81a4e283597d003e42a547a0836da5af8887f9ab7d1a694d29506
-
SSDEEP
6144:dq+vJQT/4p8NyBO6Pty0tCgbMQ5qiOXc9yb8WSif:dq+RE/4pybQybui
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW PO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2420 timeout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2452 NEW PO.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2004 2452 NEW PO.exe 31 PID 2452 wrote to memory of 2004 2452 NEW PO.exe 31 PID 2452 wrote to memory of 2004 2452 NEW PO.exe 31 PID 2452 wrote to memory of 2004 2452 NEW PO.exe 31 PID 2004 wrote to memory of 2420 2004 cmd.exe 33 PID 2004 wrote to memory of 2420 2004 cmd.exe 33 PID 2004 wrote to memory of 2420 2004 cmd.exe 33 PID 2004 wrote to memory of 2420 2004 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW PO.exe"C:\Users\Admin\AppData\Local\Temp\NEW PO.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 102⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\timeout.exetimeout 103⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2420
-
-