Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 19:19
Static task
static1
Behavioral task
behavioral1
Sample
6ef13f7a3ddf33a76cae243840076040N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6ef13f7a3ddf33a76cae243840076040N.exe
Resource
win10v2004-20240802-en
General
-
Target
6ef13f7a3ddf33a76cae243840076040N.exe
-
Size
61KB
-
MD5
6ef13f7a3ddf33a76cae243840076040
-
SHA1
f69da44625cd093a3cad283f0523600bdc2d63f6
-
SHA256
58c7b4a89c8aa920e7196091c4ab0d661ed92866af08d0fccad9e21d3757301e
-
SHA512
e7c9bb9886c8ddfe2165291e62f77f2d8ddd420332e385db66939e2c7a49912cd896bdd9601ec6e3c94d20cdd00e244bdde28a625885c8e2d903519bcfa10c66
-
SSDEEP
768:DLR7ix70zQozpW7YYCqgio1ph3Oqyqwu3YME5g0atqDhy:DLR7ix70zDzpW7YYiio1pzyixtqDQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2004 lasis.exe -
Loads dropped DLL 2 IoCs
pid Process 1720 6ef13f7a3ddf33a76cae243840076040N.exe 1720 6ef13f7a3ddf33a76cae243840076040N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ef13f7a3ddf33a76cae243840076040N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lasis.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2004 1720 6ef13f7a3ddf33a76cae243840076040N.exe 31 PID 1720 wrote to memory of 2004 1720 6ef13f7a3ddf33a76cae243840076040N.exe 31 PID 1720 wrote to memory of 2004 1720 6ef13f7a3ddf33a76cae243840076040N.exe 31 PID 1720 wrote to memory of 2004 1720 6ef13f7a3ddf33a76cae243840076040N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ef13f7a3ddf33a76cae243840076040N.exe"C:\Users\Admin\AppData\Local\Temp\6ef13f7a3ddf33a76cae243840076040N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\lasis.exe"C:\Users\Admin\AppData\Local\Temp\lasis.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5884466dad8385547321d306cd160816f
SHA16ab82b697f4fbe2990411ab740bc98cc86299a29
SHA25677011ca68581753f1d360501a0b754c805970c4153fac44ebe6780527a1a81af
SHA51287a29d9418b0524497bf73c93747199e2d746412361edcc14ef8515a9dba8fe0f3fe970bc4fa41e026901d497810d524d8ed7734c52be627f2b4a7326a1ca203