Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 23:32
Behavioral task
behavioral1
Sample
1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97.pdf
Resource
win10v2004-20240802-en
General
-
Target
1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97.pdf
-
Size
98KB
-
MD5
b70a67a6b8dc431a44eac7e66adbe8a1
-
SHA1
2758f63e30c7d57d37a92ff239c042cc234de330
-
SHA256
1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97
-
SHA512
4140b233f50436fb45ef7b479b02e4fb0e07975c94656333c5ff862de5dbf9296f7c2739e883ebf09c886c254c8bebc0f6e8a531cc6d0d3eb7315937e2f533df
-
SSDEEP
3072:yzQetvEez5q+Q5a6CPktaR/hdxj64HEPP5R:yzQeKeVq15d06aRXxNub
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3060 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3060 AcroRd32.exe 3060 AcroRd32.exe 3060 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1b68a5ab3f0d6c0e030b5390d731533ac1dd9a7798f5c101acf51d80c7b8dd97.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a3fdf7d6b54d32960fe92bec10fbcc21
SHA16deec32dcd06d32b393b2643c41f539bc8bc0a2d
SHA2564323e42edab252eac6c381fcf991b3c74656dbb6b6cd548f4a63f4eb2ad2a715
SHA512a7efb9a8230d1d733fabf072ba69a6a67d9bd355e7a872ba52f703efa6de9552b13b9d2ccb2bf2e0778e542e1e923acbd1e3386ac7ff9a0c0d3fec44cb655ba9