Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10/10/2024, 17:26
Static task
static1
Behavioral task
behavioral1
Sample
6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe
Resource
win10v2004-20241007-en
General
-
Target
6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe
-
Size
89KB
-
MD5
b62f4dc672c4d1e5422f1f66caf2c8f0
-
SHA1
1fb096e0d5d8b581285cfde9b7d601bd08f8bd2a
-
SHA256
6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0
-
SHA512
bde9e3df011e33fe6209bc6ac6b16975a658fb1105bae714148c84c8184cf35d8c9585608801f39aeaef14fb1c313e8f84d88ec97cdde98e1665c51f6881e824
-
SSDEEP
1536:f9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:f9o6fK2XqXQwhnHlqQo8Lvy
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\57C26B25 = "C:\\Users\\Admin\\AppData\\Roaming\\57C26B25\\bin.exe" winver.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe 1724 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 winver.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2556 wrote to memory of 1724 2556 6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe 31 PID 2556 wrote to memory of 1724 2556 6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe 31 PID 2556 wrote to memory of 1724 2556 6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe 31 PID 2556 wrote to memory of 1724 2556 6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe 31 PID 2556 wrote to memory of 1724 2556 6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe 31 PID 1724 wrote to memory of 1156 1724 winver.exe 21 PID 1724 wrote to memory of 1048 1724 winver.exe 17 PID 1724 wrote to memory of 1096 1724 winver.exe 19 PID 1724 wrote to memory of 1156 1724 winver.exe 21 PID 1724 wrote to memory of 1016 1724 winver.exe 25 PID 1724 wrote to memory of 2556 1724 winver.exe 30
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1048
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1096
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe"C:\Users\Admin\AppData\Local\Temp\6c5d8f8d079101010738e52752c10fd918c3c6424b83e51b89439bf5dee96fa0N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1724
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1016