Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 16:41
Static task
static1
Behavioral task
behavioral1
Sample
9d9d32c6ff763b4364b4edc33ec59590N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9d9d32c6ff763b4364b4edc33ec59590N.exe
Resource
win10v2004-20240802-en
General
-
Target
9d9d32c6ff763b4364b4edc33ec59590N.exe
-
Size
84KB
-
MD5
9d9d32c6ff763b4364b4edc33ec59590
-
SHA1
649b9f1f41200de4032a4d311cf61d8e587061e7
-
SHA256
42d0d9712e9ef0c9f058a00e5e649f02562bbe412d2c76c1fcde864b25748148
-
SHA512
f504a887149de885b2b8bc4e36605d24048452feae8f7163b9c818fb3b895d721aa1cc93650ad7337f7da0199330266cfcd7e66813fb58828e715551e65cec0a
-
SSDEEP
1536:37DBfi2c1uJCsxg6TAmSXyW4P2dP++hdc5t6FTtCmMA+ttUHxeW6Q:37DBfi2nJjGQ1LqdPXo4BtCkoUHxX6Q
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4344 set thread context of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84 -
Program crash 1 IoCs
pid pid_target Process procid_target 2440 928 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9d9d32c6ff763b4364b4edc33ec59590N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4344 wrote to memory of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84 PID 4344 wrote to memory of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84 PID 4344 wrote to memory of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84 PID 4344 wrote to memory of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84 PID 4344 wrote to memory of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84 PID 4344 wrote to memory of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84 PID 4344 wrote to memory of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84 PID 4344 wrote to memory of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84 PID 4344 wrote to memory of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84 PID 4344 wrote to memory of 928 4344 9d9d32c6ff763b4364b4edc33ec59590N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d9d32c6ff763b4364b4edc33ec59590N.exe"C:\Users\Admin\AppData\Local\Temp\9d9d32c6ff763b4364b4edc33ec59590N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\9d9d32c6ff763b4364b4edc33ec59590N.exePID:928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 4043⤵
- Program crash
PID:2440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 928 -ip 9281⤵PID:4960