Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
d2a3920599c879171cbea0ad7e5bba80N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2a3920599c879171cbea0ad7e5bba80N.exe
Resource
win10v2004-20240802-en
General
-
Target
d2a3920599c879171cbea0ad7e5bba80N.exe
-
Size
627KB
-
MD5
d2a3920599c879171cbea0ad7e5bba80
-
SHA1
fa6397588f6a365c03afe34df8b957fbc7d11ad0
-
SHA256
2a138fd3779c59999f3445ccb52acf8867051a99211e5d90c1dd8bbf5b515a16
-
SHA512
936d677e1fda0003c9205d1eb91c8287a8d38a9d3610904b2f7b863ff92c9fa719696ebe6bc3999de9129c6e8c2ac41248f88929e2729fa65d71895d64b5ec06
-
SSDEEP
12288:9R6dUnDlCiZNXD+bWfsSv7yK00G0QgZ1y:nDVNT0IF2KnI
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2a3920599c879171cbea0ad7e5bba80N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2504 wrote to memory of 1896 2504 d2a3920599c879171cbea0ad7e5bba80N.exe 31 PID 2504 wrote to memory of 1896 2504 d2a3920599c879171cbea0ad7e5bba80N.exe 31 PID 2504 wrote to memory of 1896 2504 d2a3920599c879171cbea0ad7e5bba80N.exe 31 PID 2504 wrote to memory of 1896 2504 d2a3920599c879171cbea0ad7e5bba80N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2a3920599c879171cbea0ad7e5bba80N.exe"C:\Users\Admin\AppData\Local\Temp\d2a3920599c879171cbea0ad7e5bba80N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4242⤵
- System Location Discovery: System Language Discovery
PID:1896
-