Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe
Resource
win10v2004-20240802-en
General
-
Target
56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe
-
Size
1.9MB
-
MD5
f068537841569f3c9fe628697259ec35
-
SHA1
22835ed10ec449a9aeed2eff1bd2e37686b0ba48
-
SHA256
56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68
-
SHA512
26ea35a0a6dff156eecc6fb4e596390c41be6a7dcca1f979f8829fb78dfa2cdfad28a7e4ea61058b6adbbc283d7fa35c2bcf8a2172f9000cf7d1a38705c493e8
-
SSDEEP
49152:Qoa1taC070d0Flgyh8e+VDWSJm14gW/vbL6jVm:Qoa1taC0xlgyh8Bsh4/kQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2668 5B2B.tmp -
Executes dropped EXE 1 IoCs
pid Process 2668 5B2B.tmp -
Loads dropped DLL 1 IoCs
pid Process 2180 56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B2B.tmp -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2668 2180 56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe 30 PID 2180 wrote to memory of 2668 2180 56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe 30 PID 2180 wrote to memory of 2668 2180 56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe 30 PID 2180 wrote to memory of 2668 2180 56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe"C:\Users\Admin\AppData\Local\Temp\56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\56f403ecd2e1072bd1d3008a7d028f5916ae0b0dd7f43cdc7febb3fa605eca68.exe 6B9BA14F705852ABACA16B1B6D35EC5BAECEA5A32347264969A4FD9280F08F0C2F9E64FB321145B7A47893C5EF258CCB4C79E2C80B62013CD0A452538CFC7E292⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5a4b0a9106d8dc96b0ca4c6393261481f
SHA155f2aff905960a974b4faed8ac69d98c5d418a16
SHA2560155adaa5e369e0d22cc2a39d54e6daf9686e09afca26b9262929725d8023fab
SHA5129e4ec674a9a2df2c8e811b31a3f40025d082c92908ab3ba6cecf37831d165990a56baff5d1c5023b15bff144a422790212c1595af7d3de960b7e5fc8605e43b4