Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 11:10
Static task
static1
Behavioral task
behavioral1
Sample
e00eb1b24493c57c8a26da1a6c1c1540N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e00eb1b24493c57c8a26da1a6c1c1540N.exe
Resource
win10v2004-20240802-en
General
-
Target
e00eb1b24493c57c8a26da1a6c1c1540N.exe
-
Size
134KB
-
MD5
e00eb1b24493c57c8a26da1a6c1c1540
-
SHA1
b06117cdbeac8429a7349545c1b0f77372bf8478
-
SHA256
11946c2211318baed915286df192a155e2b516537c1fafc010b29421815a7dc0
-
SHA512
517f4f4feb482f68fcd491da22d0d8eb16f939209f0c3c0b0f5fc10e9142f5576bf3fb590aa51f0448fb0791d22d3c5d472d053e74f52b1b98521bdef44c83ef
-
SSDEEP
1536:DeT7BVwxfvcguKfmy0KQbj6vbjuKoauGi4y:DmVwRUE+y0KUj6TjR9i4y
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2672 1088 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e00eb1b24493c57c8a26da1a6c1c1540N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1088 wrote to memory of 2672 1088 e00eb1b24493c57c8a26da1a6c1c1540N.exe 29 PID 1088 wrote to memory of 2672 1088 e00eb1b24493c57c8a26da1a6c1c1540N.exe 29 PID 1088 wrote to memory of 2672 1088 e00eb1b24493c57c8a26da1a6c1c1540N.exe 29 PID 1088 wrote to memory of 2672 1088 e00eb1b24493c57c8a26da1a6c1c1540N.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\e00eb1b24493c57c8a26da1a6c1c1540N.exe"C:\Users\Admin\AppData\Local\Temp\e00eb1b24493c57c8a26da1a6c1c1540N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 362⤵
- Program crash
PID:2672
-