Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
01/12/2024, 00:58
Static task
static1
Behavioral task
behavioral1
Sample
30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe
Resource
win10v2004-20241007-en
General
-
Target
30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe
-
Size
59KB
-
MD5
7273122e2b2815050c51b1812928de00
-
SHA1
b1eb72208ff290bef7143d058f4163d314939ba2
-
SHA256
30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94
-
SHA512
1a1fc69f41a28048c23dc39e0cc38886a30067d1d0036f01d60b01d3731f5dfd1652299aae1f99371e791d5b2a24ee4ce6b2181836b9558654815af27aef4a19
-
SSDEEP
768:2+6p+OMlgGMCWhfDzU7f7JDgiFP7xI57+sByZ+XsfXpwtGc9J1:2+mFM2HXKZgiFP7xIksu+XM5O9J1
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\B438E397 = "C:\\Users\\Admin\\AppData\\Roaming\\B438E397\\bin.exe" winver.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe 2460 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2460 2656 30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe 31 PID 2656 wrote to memory of 2460 2656 30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe 31 PID 2656 wrote to memory of 2460 2656 30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe 31 PID 2656 wrote to memory of 2460 2656 30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe 31 PID 2656 wrote to memory of 2460 2656 30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe 31 PID 2460 wrote to memory of 1176 2460 winver.exe 21 PID 2460 wrote to memory of 1072 2460 winver.exe 17 PID 2460 wrote to memory of 1092 2460 winver.exe 19 PID 2460 wrote to memory of 1176 2460 winver.exe 21 PID 2460 wrote to memory of 1824 2460 winver.exe 25
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1072
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1092
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe"C:\Users\Admin\AppData\Local\Temp\30497207ec26b9543a62f6d2f5c64e1438f9f3ed305f899b6350269e23806a94N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2460
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1824