Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe
Resource
win10v2004-20240802-en
General
-
Target
f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe
-
Size
68KB
-
MD5
3cd43289757de8ea1a44585f00b9ac39
-
SHA1
a23992b5e4d00d97a98df7bc85059f5dd21fa7fc
-
SHA256
f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8
-
SHA512
613df25087b57410e110da8e38758fe1c2381207f6e9d7a7d322e4bd71fb88e6e624c6d4fecfad8cfd5fb7e41e05993063c022eb06d511c7b5d8782c5edbe834
-
SSDEEP
768:6waGd7Lw/nrrxDL/GOv2/w6HSa0fYSPNZsxRXQ1d2yg/QmWKHZyiVlaW4OHZ0Em:647urp3v23HSa0AMNyfQ1d2y4Z4P
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\E5702137 = "C:\\Users\\Admin\\AppData\\Roaming\\E5702137\\bin.exe" winver.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe 2456 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2456 winver.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 1820 wrote to memory of 2264 1820 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 28 PID 2264 wrote to memory of 2456 2264 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 29 PID 2264 wrote to memory of 2456 2264 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 29 PID 2264 wrote to memory of 2456 2264 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 29 PID 2264 wrote to memory of 2456 2264 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 29 PID 2264 wrote to memory of 2456 2264 f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe 29 PID 2456 wrote to memory of 1196 2456 winver.exe 20 PID 2456 wrote to memory of 1116 2456 winver.exe 18 PID 2456 wrote to memory of 1168 2456 winver.exe 19 PID 2456 wrote to memory of 1196 2456 winver.exe 20 PID 2456 wrote to memory of 1192 2456 winver.exe 22 PID 2456 wrote to memory of 2264 2456 winver.exe 28
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe"C:\Users\Admin\AppData\Local\Temp\f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe"C:\Users\Admin\AppData\Local\Temp\f48f73ac36e0e9264bc93db8ffc198543fa0699f9b4ff4f409c45aef438fcfc8.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2456
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1192