Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/11/2024, 19:43
Static task
static1
Behavioral task
behavioral1
Sample
1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe
Resource
win10v2004-20241007-en
General
-
Target
1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe
-
Size
52KB
-
MD5
44b6794ab925a431331fdb70cef49a80
-
SHA1
805766a8cf9fd315f192c6724e0b82dad2849524
-
SHA256
1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116
-
SHA512
2907be1ec200c01550906046ff08ea1df439d1fd6e2f26632b7afe3f9401298476f7dfb2a43dd9e5113cbaa6b9a18f3f46f476f131112271f18e066cf1cc61b0
-
SSDEEP
768:0vC6RMtZNZUXeb4fXDR2JVDDISp8m7DM3pIg4LqTTUUnGg7O1/l9Jqn:MmZNZUXeQXFhS6sM3prUSGg7O1d9Jq
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\9EB7A620 = "C:\\Users\\Admin\\AppData\\Roaming\\9EB7A620\\bin.exe" winver.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe 2320 winver.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2320 winver.exe 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2320 2448 1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe 32 PID 2448 wrote to memory of 2320 2448 1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe 32 PID 2448 wrote to memory of 2320 2448 1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe 32 PID 2448 wrote to memory of 2320 2448 1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe 32 PID 2448 wrote to memory of 2320 2448 1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe 32 PID 2320 wrote to memory of 1208 2320 winver.exe 21 PID 2320 wrote to memory of 1096 2320 winver.exe 19 PID 2320 wrote to memory of 1172 2320 winver.exe 20 PID 2320 wrote to memory of 1208 2320 winver.exe 21 PID 2320 wrote to memory of 1424 2320 winver.exe 23
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1096
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe"C:\Users\Admin\AppData\Local\Temp\1064d20fc54b536bb7315852177bd379b284e9ab5865ddb7f8305b9fe8f7f116.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2320
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1424