Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 15:40
Behavioral task
behavioral1
Sample
83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778.exe
Resource
win10v2004-20241007-en
General
-
Target
83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778.exe
-
Size
72KB
-
MD5
0238ee951baf98ef0ec8c22f543d30f7
-
SHA1
eae11e1336232be34eeb8feabeaad49b1eefca0f
-
SHA256
83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778
-
SHA512
450cb05bb62b6b4eefe8a6a60ae0ceeb58f424488a607f4cd0d0ae02d06455d926ac534fe87f06d8938d8683e978ef3ee60498e770024de8aefd225decbf7d07
-
SSDEEP
1536:Is4QSZWhWM3CuNI9+VN3u2VSs2fS7epv8idzwGBMb+KR0Nc8QsJq3l:MvZLM3C7+VxI+7e2iPBe0Nc8QsCl
Malware Config
Extracted
metasploit
windows/exec
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language calc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2488 wrote to memory of 3064 2488 83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778.exe 30 PID 2488 wrote to memory of 3064 2488 83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778.exe 30 PID 2488 wrote to memory of 3064 2488 83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778.exe 30 PID 2488 wrote to memory of 3064 2488 83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778.exe"C:\Users\Admin\AppData\Local\Temp\83a5d6691825637b82b1ff811ad596a15762bf0af404032a628b7bdf0feb9778.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\calc.exeC:\Windows\System32\calc.exe2⤵
- System Location Discovery: System Language Discovery
PID:3064
-