Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 15:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240903-en
3 signatures
150 seconds
General
-
Target
loader.exe
-
Size
502KB
-
MD5
b8c9ebe29974dcb1dc86a2824761e81f
-
SHA1
27f0f4b99d4d133202375676162772728e2a521d
-
SHA256
bf5a7c45acb967fd5245aa00d88634aece445c298d783add2c5158b30ab726ac
-
SHA512
b3d2a6781ddee7ca4a4011674105818a68025f820bc4b7bdb83097df7b0cd276d3b5b849c5cb669b10d048f7e99aa4951da51203fb98475e63f4e14babb14178
-
SSDEEP
12288:gtGd6u3kxI05BOacVyXiIteS1D1wFobtFPFEuo8:gYb3owVydtFPFE1
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2080 2920 WerFault.exe 27 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language loader.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2080 2920 loader.exe 28 PID 2920 wrote to memory of 2080 2920 loader.exe 28 PID 2920 wrote to memory of 2080 2920 loader.exe 28 PID 2920 wrote to memory of 2080 2920 loader.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader.exe"C:\Users\Admin\AppData\Local\Temp\loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 1082⤵
- Program crash
PID:2080
-