Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3cvery.com/...ct.msi
windows7-x64
6cvery.com/...ct.msi
windows10-2004-x64
6cvery.com/...ct.dll
windows7-x64
3cvery.com/...ct.dll
windows10-2004-x64
1cvery.com/...en.exe
windows7-x64
3cvery.com/...en.exe
windows10-2004-x64
3cvery.com/...��.url
windows7-x64
1cvery.com/...��.url
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/09/2024, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
cvery.com/Aspose.Project.msi
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cvery.com/Aspose.Project.msi
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
cvery.com/Crack/Aspose.Project.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
cvery.com/Crack/Aspose.Project.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
cvery.com/Crack/Keygen.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
cvery.com/Crack/Keygen.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
cvery.com/非常世纪资源网.url
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
cvery.com/非常世纪资源网.url
Resource
win10v2004-20240802-en
General
-
Target
cvery.com/Crack/Keygen.exe
-
Size
180KB
-
MD5
9781d17a192caf30161a8be3de1a5af1
-
SHA1
a12c87476e3907a453714c0ff2e76a8ed4c88601
-
SHA256
2fdb05b6f2baa6b5df20269462c4ffbc5518f1c5db94c7c0eeda505432ae63b9
-
SHA512
5591dca6e7e408f28cc3e521591f139a63c32af352c871982b5b4090111bd573aeef9c46c0145f31a86a894b86c4ca41896c439500d1315b19884647d0c30701
-
SSDEEP
768:YRzTx9lsp05iBu0Km6pJtUwe7CIeID2qsUaybP/gOt2PrFz6:QT7s05D0Km6nKwClGU9P4i2Pr16
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Keygen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2472 1852 Keygen.exe 31 PID 1852 wrote to memory of 2472 1852 Keygen.exe 31 PID 1852 wrote to memory of 2472 1852 Keygen.exe 31 PID 1852 wrote to memory of 2472 1852 Keygen.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cvery.com\Crack\Keygen.exe"C:\Users\Admin\AppData\Local\Temp\cvery.com\Crack\Keygen.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4322⤵
- System Location Discovery: System Language Discovery
PID:2472
-