Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 22:37
Behavioral task
behavioral1
Sample
c7f25b3e5360ff0e1d935f176f8c58f1b59f08512135074fa5d685c61016c7d8N.pdf
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c7f25b3e5360ff0e1d935f176f8c58f1b59f08512135074fa5d685c61016c7d8N.pdf
Resource
win10v2004-20240802-en
General
-
Target
c7f25b3e5360ff0e1d935f176f8c58f1b59f08512135074fa5d685c61016c7d8N.pdf
-
Size
404KB
-
MD5
fa7cac432d4bde90f6ed0f67f2d27ca0
-
SHA1
1c6e1405500ad967cfdf0342ba618f14726d3307
-
SHA256
c7f25b3e5360ff0e1d935f176f8c58f1b59f08512135074fa5d685c61016c7d8
-
SHA512
2c51489311d50ee7b95c82ddd6e75afdc9715b5399c66a32edf62fff2e84f6d4766f8846f937706d6c5418b0c745ce4c98b278f90e43901568641236fcb7b5f1
-
SSDEEP
12288:p5LLd4QdwWsTX4i4PHpAQbeV40Vh5bhcrCBiH:7d1dlsj4p/CQw40V35I
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2492 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2492 AcroRd32.exe 2492 AcroRd32.exe 2492 AcroRd32.exe
Processes
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\c7f25b3e5360ff0e1d935f176f8c58f1b59f08512135074fa5d685c61016c7d8N.pdf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD525644875fa3a2f114d1be166920d58b9
SHA1ff0960809ea41639c815cf8e0e8e2790cb2dfdce
SHA256108e6fb180c6a9ae0fc51b5b79721e2044e593e8134cbeed5296243da165e600
SHA512ee1b955a92931ceb6cee4cd52c2c782899d13ef1eaf220c642e4be0d8100d2b70485558f2f88fac50741d3aadbeaf77f7db7222e93b7b9e2cee7e0b1a17f8559