Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/11/2024, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe
Resource
win10v2004-20241007-en
General
-
Target
223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe
-
Size
225KB
-
MD5
15bdafcca64ce276b461f76259145cb0
-
SHA1
5ff04425191cae6b861401682cbdd4cb0d5ba1d7
-
SHA256
223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342
-
SHA512
1c81c9818252bf31ffdcaa51397ac0a4e6fdc6e2ce612e9aa1eb37e09790a53ffd4dbd20baee8fb903ccb05ad136276caf93d48df90fac6518be3ffac5cccd18
-
SSDEEP
6144:LA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:LATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\BCF32D13 = "C:\\Users\\Admin\\AppData\\Roaming\\BCF32D13\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe 2808 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2808 winver.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2808 1876 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe 30 PID 1876 wrote to memory of 2808 1876 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe 30 PID 1876 wrote to memory of 2808 1876 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe 30 PID 1876 wrote to memory of 2808 1876 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe 30 PID 1876 wrote to memory of 2808 1876 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe 30 PID 2808 wrote to memory of 1260 2808 winver.exe 21 PID 2808 wrote to memory of 1128 2808 winver.exe 19 PID 2808 wrote to memory of 1184 2808 winver.exe 20 PID 2808 wrote to memory of 1260 2808 winver.exe 21 PID 2808 wrote to memory of 1544 2808 winver.exe 25 PID 2808 wrote to memory of 1876 2808 winver.exe 29
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1184
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe"C:\Users\Admin\AppData\Local\Temp\223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2808
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1544