Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
Order-940211730-pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Order-940211730-pdf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
kmnjg.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
kmnjg.exe
Resource
win10v2004-20241007-en
General
-
Target
kmnjg.exe
-
Size
170KB
-
MD5
53face3b36237ca409c4f8c277842fbe
-
SHA1
bca858bff9d11ffc6c5772c01aceee84e52a8eec
-
SHA256
8a4451db9a95c45c952c228c36d5976d5d9164077d6c9969f9206b6248963f81
-
SHA512
813ea54c1b643f5f4222bb97f82a73bcc07c9fa3ae459a748936dcff810caf19cb9771e09035e13efc1bae0ad611647dad0862d9132adf92bf01abfa7e33e31f
-
SSDEEP
3072:aD1ox12eClvt/E2AVnqybemkYdUY6U+5bpULkXq0b6:a41DClZQq2uYCpbuh
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2896 2772 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kmnjg.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2896 2772 kmnjg.exe 31 PID 2772 wrote to memory of 2896 2772 kmnjg.exe 31 PID 2772 wrote to memory of 2896 2772 kmnjg.exe 31 PID 2772 wrote to memory of 2896 2772 kmnjg.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\kmnjg.exe"C:\Users\Admin\AppData\Local\Temp\kmnjg.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 1682⤵
- Program crash
PID:2896
-