Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2024, 02:39
Static task
static1
Behavioral task
behavioral1
Sample
c08d2826bf91b133010f50f95f3aa221fc8e37b99dd05e37770ec276e4e7ad31.exe
Resource
win7-20240903-en
General
-
Target
c08d2826bf91b133010f50f95f3aa221fc8e37b99dd05e37770ec276e4e7ad31.exe
-
Size
364KB
-
MD5
ff5f5ba4b33b61d467e5a966a65b2ddf
-
SHA1
fe1cb7f63947602a20afa3daab26fec7a8ad8fe5
-
SHA256
c08d2826bf91b133010f50f95f3aa221fc8e37b99dd05e37770ec276e4e7ad31
-
SHA512
8ab629a7c108f2f2eacd398ae48dc13806a1ded07be532d9fb911183ad5438ad1e1aac355c96c72cc0c91f90bb8c76258dd67cdadb68702ff6f038d59b27695d
-
SSDEEP
1536:ozXF8CvrJ4PBhDP35r6hClProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:oh8k6DP3Z6hCltOrWKDBr+yJb
Malware Config
Extracted
gozi
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1172 1256 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c08d2826bf91b133010f50f95f3aa221fc8e37b99dd05e37770ec276e4e7ad31.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c08d2826bf91b133010f50f95f3aa221fc8e37b99dd05e37770ec276e4e7ad31.exe"C:\Users\Admin\AppData\Local\Temp\c08d2826bf91b133010f50f95f3aa221fc8e37b99dd05e37770ec276e4e7ad31.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 1922⤵
- Program crash
PID:1172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1256 -ip 12561⤵PID:1204