Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 14:53
Static task
static1
Behavioral task
behavioral1
Sample
PC6.url
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
PC6.url
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
cs1.6Ĵ/SayCn.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
cs1.6Ĵ/SayCn.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
cs1.6Ĵ/SayCn.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
cs1.6Ĵ/SayCn.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
cs1.6Ĵ/SayCn.exe
-
Size
711KB
-
MD5
69f7aaf56fc5d7e398b01f10c2d45616
-
SHA1
1577137e45f685226109fd9486f59c01f08a2b3d
-
SHA256
2a41fad23798f13d5442412e4cf1eb60bab27232a05553c4434d056c190a93a1
-
SHA512
8cb434e2b9c2a41d5731a011be10475c6fe014c96f8cc874aa7a87b19dbd5d67f36b3880189e86a42b1821de2cd25249e862e09b616faaa14a00ec47f1237902
-
SSDEEP
12288:tdgNR0EUxPNDeF1o6m16s/fxjGqu6OpyreSm7pSH7c44u:cS5DeFCxD9Fjm7pSH7c+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SayCn.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe 4884 SayCn.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4884 SayCn.exe 4884 SayCn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cs1.6Ĵ\SayCn.exe"C:\Users\Admin\AppData\Local\Temp\cs1.6Ĵ\SayCn.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4884