Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe
Resource
win7-20240903-en
General
-
Target
2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe
-
Size
474KB
-
MD5
4e4c7d398e3b40f1eabc94325e7c2750
-
SHA1
1c5a091e1835fb8fe8107317b744805988283f41
-
SHA256
2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4c
-
SHA512
b3d1df95c7c5b45dffb45078ec139a68338ffa36019507bae7c8e114ce4acc507a3c64089b1b91827b0fae1c69033a52084415862b94adae8c9081ce1a9f182a
-
SSDEEP
6144:Qw93ULOJQSfbzTRk5DJqj2uUZARLA7buDt24C6ViJ7MVhQ2KTVTpn65Q0/ISEuyu:D3ULO2IiSIbYnwJKlED6NgSNyu
Malware Config
Signatures
-
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2828 1348 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1348 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2828 1348 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe 30 PID 1348 wrote to memory of 2828 1348 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe 30 PID 1348 wrote to memory of 2828 1348 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe 30 PID 1348 wrote to memory of 2828 1348 2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe"C:\Users\Admin\AppData\Local\Temp\2e0b1df6d2c915bac926a50e91cf56294b91fbb54d9bff547ce558ea22ba3e4cN.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 1522⤵
- Program crash
PID:2828
-