Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
solicitud de cotizacion.bat.PDF.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
solicitud de cotizacion.bat.PDF.exe
Resource
win10v2004-20240802-en
General
-
Target
solicitud de cotizacion.bat.PDF.exe
-
Size
100.0MB
-
MD5
10eb6d5b5d7b28859165c4548c802b37
-
SHA1
583365e2d284286ab0d5b08a2d7e3f3c96191f26
-
SHA256
fd992317abe43162c2e420c2085eb588011f94e14887704e2baa40ee46388126
-
SHA512
f1ee38739c4e3696c9663549be54ec3093b304e9998d6ee78c7234729e2f33e0c67f6508d820f5cc67b53cc520ef93a3e4c6a6c475957a28258e6109390da88a
-
SSDEEP
24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8autKPcz5nMzzZ:YTvC/MTQYxsWR7autz
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4076 3704 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language solicitud de cotizacion.bat.PDF.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3704 solicitud de cotizacion.bat.PDF.exe 3704 solicitud de cotizacion.bat.PDF.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3704 solicitud de cotizacion.bat.PDF.exe 3704 solicitud de cotizacion.bat.PDF.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3704 wrote to memory of 2864 3704 solicitud de cotizacion.bat.PDF.exe 89 PID 3704 wrote to memory of 2864 3704 solicitud de cotizacion.bat.PDF.exe 89 PID 3704 wrote to memory of 2864 3704 solicitud de cotizacion.bat.PDF.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\solicitud de cotizacion.bat.PDF.exe"C:\Users\Admin\AppData\Local\Temp\solicitud de cotizacion.bat.PDF.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\solicitud de cotizacion.bat.PDF.exe"2⤵PID:2864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 7682⤵
- Program crash
PID:4076
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3704 -ip 37041⤵PID:2448