Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 01:23
Static task
static1
Behavioral task
behavioral1
Sample
b6924326974a840d6bdbc9065db9f8e15f8ac0af0e6cdd8b51e356d4775127d2.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b6924326974a840d6bdbc9065db9f8e15f8ac0af0e6cdd8b51e356d4775127d2.exe
Resource
win10v2004-20240802-en
General
-
Target
b6924326974a840d6bdbc9065db9f8e15f8ac0af0e6cdd8b51e356d4775127d2.exe
-
Size
468KB
-
MD5
9e7640a0516f9306c3e93e4f391abbd7
-
SHA1
c8ecd857b707a614f2318a5cf79590a2be091df1
-
SHA256
b6924326974a840d6bdbc9065db9f8e15f8ac0af0e6cdd8b51e356d4775127d2
-
SHA512
d97c0f2ccfde059856bb6280c955a47b11c0c8051c0a13bc014c6b1e33036dd19c446dcb34edb232782c3ff120e2e90756e7fb4267a138d5eab258938286e9df
-
SSDEEP
3072:1GeeoEIVq05UubYMH5cOcf8/LChsZ0p1nFHewVP9qPp+cS0sv4l/:1GXom8UuTHSOcf6Yi6qPgn0sv
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4596 4612 WerFault.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b6924326974a840d6bdbc9065db9f8e15f8ac0af0e6cdd8b51e356d4775127d2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4612 b6924326974a840d6bdbc9065db9f8e15f8ac0af0e6cdd8b51e356d4775127d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6924326974a840d6bdbc9065db9f8e15f8ac0af0e6cdd8b51e356d4775127d2.exe"C:\Users\Admin\AppData\Local\Temp\b6924326974a840d6bdbc9065db9f8e15f8ac0af0e6cdd8b51e356d4775127d2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 7242⤵
- Program crash
PID:4596
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4612 -ip 46121⤵PID:4000