Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe
Resource
win10v2004-20240802-en
General
-
Target
e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe
-
Size
1.1MB
-
MD5
4b70c15a9453a8378dce494d0e311320
-
SHA1
107c33ac1ea6a2d50135c2ce51771abdad716f93
-
SHA256
e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd
-
SHA512
c3626a9a235e3363a7638a799f9f1c8c66477a17e201543cc2ef19ddb62a466b8bf318c26eb3a7e59517074ab481d721546bc1311051cd5769284311a5916e3d
-
SSDEEP
24576:aH0dl8myX9Bg42QoXFkrzkmplSgRDYo0lG4Z8r7Qfbkiu5Q5:acallSllG4ZM7QzM6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2520 e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2520 e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2520 e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2520 e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe 2520 e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2520 wrote to memory of 1260 2520 e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe 30 PID 2520 wrote to memory of 1260 2520 e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe 30 PID 2520 wrote to memory of 1260 2520 e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe 30 PID 2520 wrote to memory of 1260 2520 e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe"C:\Users\Admin\AppData\Local\Temp\e110e9c15cda97a9fa6b03b1a9625c7333f22405f78dcb327d930cd73fca8abd.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
PID:1260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
753B
MD5df5547065cac758c6a4058ce7c051225
SHA1e603111277ffbc84b77c03107a8f86896162f13a
SHA256049c3195ffa87d98b7cf4630ad9d9874715ca6fe80c89f66beadf0b165f60933
SHA512dddc79b7470b025417e5962de8dd0cb76898cd4a0fa8159d31cc3b104236e7dbaba460a86f71a005d6160dd21c2cfd77c20012f0804aa2c86daa799488e5541e