Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/10/2024, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
New order.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
New order.exe
Resource
win10v2004-20240802-en
General
-
Target
New order.exe
-
Size
1.0MB
-
MD5
cc0e7f78f732294205367b63c08b112f
-
SHA1
2994128f0369ad6fb19c2b70b10d1150126718f1
-
SHA256
1ddb5066864496c4fdb477252d09eee2f3304d5801c93bc9a72acb22eb78523b
-
SHA512
1f2f2a93354b467eada7729c10a7e40b54073d484dd18ee64f04a88d6bdb9672cbbb6e998b671c54c3dceb306c6ff01ce3ca74681f7dadc280e6ce00f6fe88d7
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLgssNh4LygQJgrmCeYdc00c:f3v+7/5QLgL7lJgr5N9
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4488 4876 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New order.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4876 wrote to memory of 4324 4876 New order.exe 82 PID 4876 wrote to memory of 4324 4876 New order.exe 82 PID 4876 wrote to memory of 4324 4876 New order.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\New order.exe"C:\Users\Admin\AppData\Local\Temp\New order.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\New order.exe"2⤵PID:4324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 7402⤵
- Program crash
PID:4488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4876 -ip 48761⤵PID:3308