Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
34s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
3ed0027cc70689f8c49d21130e910300N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3ed0027cc70689f8c49d21130e910300N.exe
Resource
win10v2004-20240802-en
General
-
Target
3ed0027cc70689f8c49d21130e910300N.exe
-
Size
44KB
-
MD5
3ed0027cc70689f8c49d21130e910300
-
SHA1
96a0540b72de096dbbc1e34cb7b74e37afc5d8f4
-
SHA256
5feeb263237809d64b91fdda88da145df7ae325a982b85f26428924aba383b0b
-
SHA512
d3d4cba9a8bc9eab1503bc549cff396b24a04903fff7b402fce48848dc1d22a0db7c5c6ca2f30d015cda578f90d84ad6772b7b9041065172dfa83547a35ff72d
-
SSDEEP
768:XYqTTIINYPjrxIF0GKZ15f8TeCA4SR/sAxSTKDTho00LEqDnc9W5QE:XYcNY0KZrtBxSTKRo0gEEc9W5QE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2956 ffengh.exe -
Loads dropped DLL 2 IoCs
pid Process 1232 3ed0027cc70689f8c49d21130e910300N.exe 1232 3ed0027cc70689f8c49d21130e910300N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffengh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ed0027cc70689f8c49d21130e910300N.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 ffengh.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 ffengh.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1232 wrote to memory of 2956 1232 3ed0027cc70689f8c49d21130e910300N.exe 30 PID 1232 wrote to memory of 2956 1232 3ed0027cc70689f8c49d21130e910300N.exe 30 PID 1232 wrote to memory of 2956 1232 3ed0027cc70689f8c49d21130e910300N.exe 30 PID 1232 wrote to memory of 2956 1232 3ed0027cc70689f8c49d21130e910300N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ed0027cc70689f8c49d21130e910300N.exe"C:\Users\Admin\AppData\Local\Temp\3ed0027cc70689f8c49d21130e910300N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\ffengh.exe"C:\Users\Admin\AppData\Local\Temp\ffengh.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD5183e5c13075e9dc47e6ee821a54fe721
SHA1f4e022bd47642c9104a15b4645ad3a6c66775490
SHA2564e25e0f4694e130f499977284361cd4667db14845d6bf6e13c6e0ec6321eb7b5
SHA5124619d255d5ef7ae66c9e49a8dc66393000b12e42531056f88e219b130a3ef362bd2c7baeeba7adb51bae181342c37bf4df2127baa9e4a33a5440f6771dda5162