Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 01:35
Behavioral task
behavioral1
Sample
5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe
Resource
win7-20241010-en
8 signatures
120 seconds
General
-
Target
5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe
-
Size
89KB
-
MD5
308d30e8b0b45c198ec2107d97eedeff
-
SHA1
dc394a59b50ac780cfed32415bc0da2dc77fae12
-
SHA256
5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4
-
SHA512
f0c7bdb7a6b392da4c4d02ff845ad4606019087aabe372136bf6159922db47fe702e7784548b9f478e2a5087278cc842a212abfda8e50aac55d69a7de4131a69
-
SSDEEP
1536:hr+mFM2HXKZgixhIksu+XM5/HtAQ9Jox76:l+4MJIkLZJNAQ9Jo96
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\E4D0363E = "C:\\Users\\Admin\\AppData\\Roaming\\E4D0363E\\bin.exe" winver.exe -
resource yara_rule behavioral1/memory/1976-0-0x0000000000400000-0x0000000000418000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe 2040 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2040 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2040 1976 5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe 31 PID 1976 wrote to memory of 2040 1976 5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe 31 PID 1976 wrote to memory of 2040 1976 5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe 31 PID 1976 wrote to memory of 2040 1976 5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe 31 PID 1976 wrote to memory of 2040 1976 5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe 31 PID 2040 wrote to memory of 1200 2040 winver.exe 21 PID 2040 wrote to memory of 1104 2040 winver.exe 19 PID 2040 wrote to memory of 1176 2040 winver.exe 20 PID 2040 wrote to memory of 1200 2040 winver.exe 21 PID 2040 wrote to memory of 1632 2040 winver.exe 25
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe"C:\Users\Admin\AppData\Local\Temp\5991ad27b5575c625d9ee1b6439f464a05780adc0032c80140658ae73693edf4.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2040
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1632