Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/09/2024, 13:33

General

  • Target

    cvery.com/Crack/Keygen.exe

  • Size

    180KB

  • MD5

    9781d17a192caf30161a8be3de1a5af1

  • SHA1

    a12c87476e3907a453714c0ff2e76a8ed4c88601

  • SHA256

    2fdb05b6f2baa6b5df20269462c4ffbc5518f1c5db94c7c0eeda505432ae63b9

  • SHA512

    5591dca6e7e408f28cc3e521591f139a63c32af352c871982b5b4090111bd573aeef9c46c0145f31a86a894b86c4ca41896c439500d1315b19884647d0c30701

  • SSDEEP

    768:YRzTx9lsp05iBu0Km6pJtUwe7CIeID2qsUaybP/gOt2PrFz6:QT7s05D0Km6nKwClGU9P4i2Pr16

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cvery.com\Crack\Keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\cvery.com\Crack\Keygen.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 432
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1852-0-0x0000000074381000-0x0000000074382000-memory.dmp

    Filesize

    4KB

  • memory/1852-1-0x0000000074380000-0x000000007492B000-memory.dmp

    Filesize

    5.7MB

  • memory/1852-2-0x0000000074380000-0x000000007492B000-memory.dmp

    Filesize

    5.7MB

  • memory/1852-4-0x0000000074380000-0x000000007492B000-memory.dmp

    Filesize

    5.7MB

  • memory/2472-3-0x0000000002050000-0x0000000002051000-memory.dmp

    Filesize

    4KB

  • memory/2472-5-0x0000000002050000-0x0000000002051000-memory.dmp

    Filesize

    4KB