Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 02:15
Static task
static1
Behavioral task
behavioral1
Sample
869104e0d8ee831e7f3f4666f080efa0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
869104e0d8ee831e7f3f4666f080efa0N.exe
Resource
win10v2004-20240802-en
General
-
Target
869104e0d8ee831e7f3f4666f080efa0N.exe
-
Size
5KB
-
MD5
869104e0d8ee831e7f3f4666f080efa0
-
SHA1
45724962f1a005e7db2e4019a5d840d8b7aac6e9
-
SHA256
60c478e716ef2256066a788151d473c2aeb72c22d9ddc5676ee78d75027f3414
-
SHA512
651eb79b9bf27f1b6ab6b3f54e6f4d06af2d10cffb89716c46e5aeeefb9848a6d8f8a45964115ea1693d86bff61868f3c6318f7dba79efd7b4e20082ba8d34d5
-
SSDEEP
48:S1lXWFPpT+dXVfzZh4yMGcKzMEkTaak4PAZivO2pB42pBdvMZL2R7tmRuqSxp:2WLkFfNnOKYloIQ2pm2pbYSSxE
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2176 2232 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 869104e0d8ee831e7f3f4666f080efa0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2176 2232 869104e0d8ee831e7f3f4666f080efa0N.exe 30 PID 2232 wrote to memory of 2176 2232 869104e0d8ee831e7f3f4666f080efa0N.exe 30 PID 2232 wrote to memory of 2176 2232 869104e0d8ee831e7f3f4666f080efa0N.exe 30 PID 2232 wrote to memory of 2176 2232 869104e0d8ee831e7f3f4666f080efa0N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\869104e0d8ee831e7f3f4666f080efa0N.exe"C:\Users\Admin\AppData\Local\Temp\869104e0d8ee831e7f3f4666f080efa0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 482⤵
- Program crash
PID:2176
-