Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 18:03 UTC
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
file.exe
-
Size
896KB
-
MD5
ea94163d40e5cb504778dc729ef519f1
-
SHA1
febde4e5f6373200e5daae74277adf576c76158a
-
SHA256
0c19bad7c0ab86a954f8d5cb8b0fc410bb8a792fa0a63140197db4f65e6af6c5
-
SHA512
46f2cdff5a9c72f18b268ed32f75e05d0262d1f12fcd155fef0e98ab9875dca752da4b1a58d66177c0daa8ed3b987da4c26be443391ac89b0e2f96d990891159
-
SSDEEP
12288:XqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaoT0:XqDEvCTbMWu7rQYlBQcBiT6rprG8aw0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe 2336 file.exe