Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/11/2024, 11:19
Behavioral task
behavioral1
Sample
696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632.exe
Resource
win7-20240903-en
8 signatures
150 seconds
General
-
Target
696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632.exe
-
Size
49KB
-
MD5
c5a8aab2c6e10c6944b026e0cef68873
-
SHA1
12a5064c6cef6978e888ac6665c28c7f7e9363d0
-
SHA256
696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632
-
SHA512
fe70bd855a109f00b2e57e0a0391aabb71831ad535452a795788a629027617d50bf339aa387ac771dd4c3b2fe3ae8c26943017176fdcc1c66eebb37566737a85
-
SSDEEP
1536:iOBLXNqgzf2v6b6NkXklZlogHGe9eBXWV:iYLduv6OqXIlogmjWV
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\89A49429 = "C:\\Users\\Admin\\AppData\\Roaming\\89A49429\\bin.exe" winver.exe -
resource yara_rule behavioral1/memory/3000-0-0x0000000000400000-0x000000000041D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe 2372 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2372 3000 696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632.exe 31 PID 3000 wrote to memory of 2372 3000 696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632.exe 31 PID 3000 wrote to memory of 2372 3000 696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632.exe 31 PID 3000 wrote to memory of 2372 3000 696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632.exe 31 PID 3000 wrote to memory of 2372 3000 696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632.exe 31 PID 2372 wrote to memory of 1076 2372 winver.exe 18 PID 2372 wrote to memory of 1044 2372 winver.exe 17 PID 2372 wrote to memory of 1076 2372 winver.exe 18 PID 2372 wrote to memory of 1112 2372 winver.exe 20 PID 2372 wrote to memory of 2020 2372 winver.exe 23
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1044
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632.exe"C:\Users\Admin\AppData\Local\Temp\696294bbf0c2aa9c3f837134634983348056d02b2609ac42c4ad7f09c6e9a632.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2372
-
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2020