Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/11/2024, 09:07
Static task
static1
Behavioral task
behavioral1
Sample
d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe
Resource
win10v2004-20241007-en
General
-
Target
d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe
-
Size
89KB
-
MD5
c4a96d1eb525e2f6aaf5acd1e2221b80
-
SHA1
35f13d21cd53c08c35fe45906f2750a56e68b5d2
-
SHA256
d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01
-
SHA512
22c98a829357f26ff863374b2fd545356aba301265068df14c900881ea4a848caa43e3cdd9aa3c619b01fc2f15c856bcbdd1b7a4b065dccedf120a9efa571b49
-
SSDEEP
1536:x9o65gQK3Zm+Mt9RV5O8oQ9cXFunGm6ManhFLnBqHan6owwosTk8vxA:x9o6fK2XqXQwhnHlqQo8Lvy
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\7F1E4F38 = "C:\\Users\\Admin\\AppData\\Roaming\\7F1E4F38\\bin.exe" winver.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe 1660 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1660 winver.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1660 2112 d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe 30 PID 2112 wrote to memory of 1660 2112 d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe 30 PID 2112 wrote to memory of 1660 2112 d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe 30 PID 2112 wrote to memory of 1660 2112 d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe 30 PID 2112 wrote to memory of 1660 2112 d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe 30 PID 1660 wrote to memory of 1128 1660 winver.exe 20 PID 1660 wrote to memory of 1044 1660 winver.exe 17 PID 1660 wrote to memory of 1068 1660 winver.exe 18 PID 1660 wrote to memory of 1128 1660 winver.exe 20 PID 1660 wrote to memory of 1996 1660 winver.exe 23 PID 1660 wrote to memory of 2112 1660 winver.exe 29
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1044
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1068
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe"C:\Users\Admin\AppData\Local\Temp\d36f0b687676c4426e2190b4a9e54dd25a8f6f491de2d7f7e827c1684675be01N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1660
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1996