Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 03:36
Static task
static1
Behavioral task
behavioral1
Sample
cb6d35c0b0c9b431483af252c74353a0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cb6d35c0b0c9b431483af252c74353a0N.exe
Resource
win10v2004-20240802-en
General
-
Target
cb6d35c0b0c9b431483af252c74353a0N.exe
-
Size
134KB
-
MD5
cb6d35c0b0c9b431483af252c74353a0
-
SHA1
8009d0816f351f6299b81ac86eb61de54e9ea014
-
SHA256
1ed1dbd2a6f139b88cf43c00fab1fea008a9919729c77f1c1752ca06ef3b0d4a
-
SHA512
00a27edd9f8b90d8a2620c8faa0e947219e5e159cb15a6b14186f44955fa5b33a1f9cf3946b5aa0dd7cfd37e613ad3a5dbcc644774c305a09c4333b328b2bc8a
-
SSDEEP
1536:DeT7BVwxfvcguKfmy0KQbj6vbjuKoauGi4a:DmVwRUE+y0KUj6TjR9i4a
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2096 2440 WerFault.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb6d35c0b0c9b431483af252c74353a0N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2096 2440 cb6d35c0b0c9b431483af252c74353a0N.exe 29 PID 2440 wrote to memory of 2096 2440 cb6d35c0b0c9b431483af252c74353a0N.exe 29 PID 2440 wrote to memory of 2096 2440 cb6d35c0b0c9b431483af252c74353a0N.exe 29 PID 2440 wrote to memory of 2096 2440 cb6d35c0b0c9b431483af252c74353a0N.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb6d35c0b0c9b431483af252c74353a0N.exe"C:\Users\Admin\AppData\Local\Temp\cb6d35c0b0c9b431483af252c74353a0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 362⤵
- Program crash
PID:2096
-