Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05/11/2024, 15:50
Behavioral task
behavioral1
Sample
1380-311-0x0000000000870000-0x0000000000FAC000-memory.exe
Resource
win7-20240903-en
2 signatures
150 seconds
General
-
Target
1380-311-0x0000000000870000-0x0000000000FAC000-memory.exe
-
Size
7.2MB
-
MD5
e1ffd3e99150d0f849736b37828e4bd5
-
SHA1
941c01e3c60863063fad177b8b4c807b266b588f
-
SHA256
5af325ebdcf61f7f75a4a56611c2933b38e0b20f5c3f3a14ea6715a19ea2b731
-
SHA512
f24ca3212cca0ecc07ef4e9736c666136f2fed7927d7334ddd32e86170a81814365ce24ddf3f31d149376f3d24fa2fad3150de2e39f5b62d4e6883043ed12e70
-
SSDEEP
98304:7EGJtF4RIwyb/Cp8cVBcu2D/J3BFbsD7LXIi479DyJo9BjvKFT:gGh6yb/Cp2xn8QpKFT
Malware Config
Signatures
-
Stealc family
-
Program crash 1 IoCs
pid pid_target Process procid_target 736 4948 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1380-311-0x0000000000870000-0x0000000000FAC000-memory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1380-311-0x0000000000870000-0x0000000000FAC000-memory.exe"C:\Users\Admin\AppData\Local\Temp\1380-311-0x0000000000870000-0x0000000000FAC000-memory.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4948 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 2162⤵
- Program crash
PID:736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4948 -ip 49481⤵PID:868