Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2024, 20:19

General

  • Target

    kmnjg.exe

  • Size

    170KB

  • MD5

    53face3b36237ca409c4f8c277842fbe

  • SHA1

    bca858bff9d11ffc6c5772c01aceee84e52a8eec

  • SHA256

    8a4451db9a95c45c952c228c36d5976d5d9164077d6c9969f9206b6248963f81

  • SHA512

    813ea54c1b643f5f4222bb97f82a73bcc07c9fa3ae459a748936dcff810caf19cb9771e09035e13efc1bae0ad611647dad0862d9132adf92bf01abfa7e33e31f

  • SSDEEP

    3072:aD1ox12eClvt/E2AVnqybemkYdUY6U+5bpULkXq0b6:a41DClZQq2uYCpbuh

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\kmnjg.exe
    "C:\Users\Admin\AppData\Local\Temp\kmnjg.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 168
      2⤵
      • Program crash
      PID:2896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads