Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/12/2024, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe
Resource
win10v2004-20241007-en
General
-
Target
12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe
-
Size
610KB
-
MD5
e47eabb28ef94e36bb9a1891377cf990
-
SHA1
790e07a16c9320ee0f1983d998eb5058af51bd96
-
SHA256
12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382
-
SHA512
e0a7e33d52c9f4b52b7964c7ec415eef7638d926f23bbb646bc5cfcad9c3ae494f1987d4e0162e2b98e93ce57dacb49e590a85049d7a48f15fa056e82fab71ba
-
SSDEEP
12288:mATuTAnKGwUAW3ycQqgYo3CyWoKEY3ZQi7gfqOuuh+c:4T+KjUdQqboyyWoK1NGqzuhb
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\1B72FB3A = "C:\\Users\\Admin\\AppData\\Roaming\\1B72FB3A\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe 2796 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2796 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2796 1716 12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe 31 PID 1716 wrote to memory of 2796 1716 12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe 31 PID 1716 wrote to memory of 2796 1716 12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe 31 PID 1716 wrote to memory of 2796 1716 12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe 31 PID 1716 wrote to memory of 2796 1716 12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe 31 PID 2796 wrote to memory of 1188 2796 winver.exe 21 PID 2796 wrote to memory of 1112 2796 winver.exe 19 PID 2796 wrote to memory of 1160 2796 winver.exe 20 PID 2796 wrote to memory of 1188 2796 winver.exe 21 PID 2796 wrote to memory of 2008 2796 winver.exe 23
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe"C:\Users\Admin\AppData\Local\Temp\12f6f96fbe2f67a220d2d838fa356ef6cadfcc0f99f943ccf1db4c2564ddb382N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2796
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2008