Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 01:35
Static task
static1
Behavioral task
behavioral1
Sample
8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe
Resource
win10v2004-20240802-en
General
-
Target
8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe
-
Size
1.1MB
-
MD5
185e7b21891df251d8878b5b74ebc2d4
-
SHA1
c71bf93e1cafe3d03ece648a2a2e6b526562d840
-
SHA256
8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a
-
SHA512
e8f9cf41b2de985f61a13e73e4f6b6dc980ebd6d9ce839956e26ae7c855c838b1a162b79a26942e078ed3f696972be0072260bab23b9e3c4cdd401ef2a6e367f
-
SSDEEP
24576:fAHnh+eWsN3skA4RV1Hom2KXMmHa18HQm1O+2IsAPD2Yz5:Ch+ZkldoPK8Ya1cQ8sAPf
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2292 set thread context of 2500 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2500 svchost.exe 2500 svchost.exe 2500 svchost.exe 2500 svchost.exe 2500 svchost.exe 2500 svchost.exe 2500 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2500 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe 30 PID 2292 wrote to memory of 2500 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe 30 PID 2292 wrote to memory of 2500 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe 30 PID 2292 wrote to memory of 2500 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe 30 PID 2292 wrote to memory of 2500 2292 8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe"C:\Users\Admin\AppData\Local\Temp\8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\8c93a7310543718620f4ccd70e8bcaf1764cf48c16ddf43ed9ae3e79d6b61e0a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD580c1a581d881a6712024299c0d2b6e20
SHA1cbfdc1a6f500e4d6f44e56839f8d50ab852dc230
SHA256e5ab72023abc9e77ce49c9b92bc30f70c17c4a14020e811da26925a2b873c485
SHA512597a7e5884e4d636e5d54812d7cfebdd7c1ef029938d23cbfa8dd599dbf6a1920a3f850d5fd40c172f0601471ae45ce9e1b7a197b011cdf3e821e9262751dd85