Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 11:40
Behavioral task
behavioral1
Sample
17d036f3009623675e962d5147518a6d78f31d52e84e07cceb38a0f7176cfdaf.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
17d036f3009623675e962d5147518a6d78f31d52e84e07cceb38a0f7176cfdaf.pdf
Resource
win10v2004-20240802-en
General
-
Target
17d036f3009623675e962d5147518a6d78f31d52e84e07cceb38a0f7176cfdaf.pdf
-
Size
72KB
-
MD5
a42b9cb2c37a8cf2b898519d6166e0b9
-
SHA1
6ecb99673e67853bc3afc0670ef719b3976fbf25
-
SHA256
17d036f3009623675e962d5147518a6d78f31d52e84e07cceb38a0f7176cfdaf
-
SHA512
ef8a181eebd9732705f79e01638c9d9b432057723520bb50e542b4c27909b4c8b7b0ecec17d8fe5fad1537f322d0652cfbdcbfa0340890da7be937c4bbd62dfe
-
SSDEEP
1536:f0SNCCHuM0jJaM9LvsLnrOoCC+ZWbpONLI9V9jvHWxEmJ9S6Rt:cKeHjwMBvsLrOfbNLI9fbyJ93
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1852 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1852 AcroRd32.exe 1852 AcroRd32.exe 1852 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\17d036f3009623675e962d5147518a6d78f31d52e84e07cceb38a0f7176cfdaf.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50c05ca1c8e5b81f9267949f9527f9710
SHA18f1301be0f00dda03628bfbf47a8bb6197716c46
SHA256611c7e597aaae07ea499fd12da2c3ad9b547ad48238736536292a7a3da3a6fc7
SHA512b4193475c5b74457c0f72fa365904ecf83fb02bda4b95ee36fc30218a2fca237a3468979cc352b0f29ff460576074d10a2ec77f002c51e85d4b0a0be9d76a88c