Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
24s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 09:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe
-
Size
159KB
-
MD5
70e0ec444e51ea02174ec13c02a9fb26
-
SHA1
69ece913a8597d55722bad0f3c311da368923c6b
-
SHA256
d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382
-
SHA512
e018598c1c0728ba81c5fea4c4f36864f195643d82236859ecb5031752df368b3eea81bb675a7784b2a0c7c537f65f0d7d1adccad4424433d757eee318b623fb
-
SSDEEP
3072:xkY4k28GEHx1UG2c0IsWnR3FPy+3ZiA/kIKeI6+zCPLBNecbPdB+XGSlZ51Jd4+X:x3U8GER27c0ArBl/E6o4LBNecUeul
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language whoami.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2684 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2692 systeminfo.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
description pid Process Token: SeDebugPrivilege 2764 whoami.exe Token: SeIncreaseQuotaPrivilege 2704 WMIC.exe Token: SeSecurityPrivilege 2704 WMIC.exe Token: SeTakeOwnershipPrivilege 2704 WMIC.exe Token: SeLoadDriverPrivilege 2704 WMIC.exe Token: SeSystemProfilePrivilege 2704 WMIC.exe Token: SeSystemtimePrivilege 2704 WMIC.exe Token: SeProfSingleProcessPrivilege 2704 WMIC.exe Token: SeIncBasePriorityPrivilege 2704 WMIC.exe Token: SeCreatePagefilePrivilege 2704 WMIC.exe Token: SeBackupPrivilege 2704 WMIC.exe Token: SeRestorePrivilege 2704 WMIC.exe Token: SeShutdownPrivilege 2704 WMIC.exe Token: SeDebugPrivilege 2704 WMIC.exe Token: SeSystemEnvironmentPrivilege 2704 WMIC.exe Token: SeRemoteShutdownPrivilege 2704 WMIC.exe Token: SeUndockPrivilege 2704 WMIC.exe Token: SeManageVolumePrivilege 2704 WMIC.exe Token: 33 2704 WMIC.exe Token: 34 2704 WMIC.exe Token: 35 2704 WMIC.exe Token: SeIncreaseQuotaPrivilege 2704 WMIC.exe Token: SeSecurityPrivilege 2704 WMIC.exe Token: SeTakeOwnershipPrivilege 2704 WMIC.exe Token: SeLoadDriverPrivilege 2704 WMIC.exe Token: SeSystemProfilePrivilege 2704 WMIC.exe Token: SeSystemtimePrivilege 2704 WMIC.exe Token: SeProfSingleProcessPrivilege 2704 WMIC.exe Token: SeIncBasePriorityPrivilege 2704 WMIC.exe Token: SeCreatePagefilePrivilege 2704 WMIC.exe Token: SeBackupPrivilege 2704 WMIC.exe Token: SeRestorePrivilege 2704 WMIC.exe Token: SeShutdownPrivilege 2704 WMIC.exe Token: SeDebugPrivilege 2704 WMIC.exe Token: SeSystemEnvironmentPrivilege 2704 WMIC.exe Token: SeRemoteShutdownPrivilege 2704 WMIC.exe Token: SeUndockPrivilege 2704 WMIC.exe Token: SeManageVolumePrivilege 2704 WMIC.exe Token: 33 2704 WMIC.exe Token: 34 2704 WMIC.exe Token: 35 2704 WMIC.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2800 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 31 PID 2188 wrote to memory of 2800 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 31 PID 2188 wrote to memory of 2800 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 31 PID 2188 wrote to memory of 2800 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 31 PID 2800 wrote to memory of 2764 2800 cmd.exe 32 PID 2800 wrote to memory of 2764 2800 cmd.exe 32 PID 2800 wrote to memory of 2764 2800 cmd.exe 32 PID 2800 wrote to memory of 2764 2800 cmd.exe 32 PID 2188 wrote to memory of 2756 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 33 PID 2188 wrote to memory of 2756 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 33 PID 2188 wrote to memory of 2756 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 33 PID 2188 wrote to memory of 2756 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 33 PID 2756 wrote to memory of 2684 2756 cmd.exe 34 PID 2756 wrote to memory of 2684 2756 cmd.exe 34 PID 2756 wrote to memory of 2684 2756 cmd.exe 34 PID 2756 wrote to memory of 2684 2756 cmd.exe 34 PID 2188 wrote to memory of 2780 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 35 PID 2188 wrote to memory of 2780 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 35 PID 2188 wrote to memory of 2780 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 35 PID 2188 wrote to memory of 2780 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 35 PID 2188 wrote to memory of 2536 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 36 PID 2188 wrote to memory of 2536 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 36 PID 2188 wrote to memory of 2536 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 36 PID 2188 wrote to memory of 2536 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 36 PID 2536 wrote to memory of 2704 2536 cmd.exe 37 PID 2536 wrote to memory of 2704 2536 cmd.exe 37 PID 2536 wrote to memory of 2704 2536 cmd.exe 37 PID 2536 wrote to memory of 2704 2536 cmd.exe 37 PID 2188 wrote to memory of 2700 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 39 PID 2188 wrote to memory of 2700 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 39 PID 2188 wrote to memory of 2700 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 39 PID 2188 wrote to memory of 2700 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 39 PID 2700 wrote to memory of 2692 2700 cmd.exe 40 PID 2700 wrote to memory of 2692 2700 cmd.exe 40 PID 2700 wrote to memory of 2692 2700 cmd.exe 40 PID 2700 wrote to memory of 2692 2700 cmd.exe 40 PID 2188 wrote to memory of 448 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 42 PID 2188 wrote to memory of 448 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 42 PID 2188 wrote to memory of 448 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 42 PID 2188 wrote to memory of 448 2188 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe"C:\Users\Admin\AppData\Local\Temp\d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c whoami2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\whoami.exewhoami3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo %USERPROFILE%\Desktop2⤵
- System Location Discovery: System Language Discovery
PID:2780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic diskdrive get serialnumber3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c systeminfo2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo3⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:2692
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir C:\Users\Admin\\Desktop2⤵
- System Location Discovery: System Language Discovery
PID:448
-