Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
11/11/2024, 13:13
Static task
static1
Behavioral task
behavioral1
Sample
8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe
Resource
win10v2004-20241007-en
General
-
Target
8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe
-
Size
88KB
-
MD5
10db7b723c7d9344e3b9c09b9222dc4b
-
SHA1
339feb4b1c134a732ec6f5d3777f52180510e6a9
-
SHA256
7e200ff586f0396ef01e9f527c1d32908fd56150e6886f5b7927c1cf382d643e
-
SHA512
fafe71a75ee9b02b1d99fc204e0d893c05c75f90dce8b212a6c4f13548297b18dcde019503e3c0630f624c7a22c756df000afb869e9ab98131050d0ef4f41cb8
-
SSDEEP
1536:Az44CpRkr9DXhHf3aOd/56RrkQqjh+rmKVsNz:AzvokZR/KM/ysjwqWsNz
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\1B77DBF5 = "C:\\Users\\Admin\\AppData\\Roaming\\1B77DBF5\\bin.exe" winver.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe 1476 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1476 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1476 2368 8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe 31 PID 2368 wrote to memory of 1476 2368 8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe 31 PID 2368 wrote to memory of 1476 2368 8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe 31 PID 2368 wrote to memory of 1476 2368 8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe 31 PID 2368 wrote to memory of 1476 2368 8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe 31 PID 1476 wrote to memory of 1248 1476 winver.exe 21 PID 1476 wrote to memory of 1116 1476 winver.exe 19 PID 1476 wrote to memory of 1192 1476 winver.exe 20 PID 1476 wrote to memory of 1248 1476 winver.exe 21 PID 1476 wrote to memory of 1124 1476 winver.exe 23
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1192
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe"C:\Users\Admin\AppData\Local\Temp\8449018f15ad45b48d46f4184466284cf6521a5b471e04e5c895f3f036ade6c3N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1476
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1124