Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/12/2024, 21:35
Behavioral task
behavioral1
Sample
3416-0-0x00000000010D0000-0x000000000176C000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3416-0-0x00000000010D0000-0x000000000176C000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
3416-0-0x00000000010D0000-0x000000000176C000-memory.exe
-
Size
6.6MB
-
MD5
a50d45b8f823896638d6c2a6a5a4a24e
-
SHA1
62042581c9d5f892d3060fd2e0947203800a9801
-
SHA256
21bd29865491e7e83d5c3b1c58d885e9086502cc211c8e08c739e79ce5ec9313
-
SHA512
0a49d12178d74c725c7f7bcbfcd740e7434bdaaaad3d54fea9b227e6a33715025b8fe933d6b041357c2a68376d49893882f06833dfe64718691b434aab48a5a3
-
SSDEEP
12288:rXSnfn7rq3WjiUoXXdQQnt6T85HRUgamA777vzq:zSnfn7rq3WjiUoXXdQQnt6T85HR5Ai
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1548 2016 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3416-0-0x00000000010D0000-0x000000000176C000-memory.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1548 2016 3416-0-0x00000000010D0000-0x000000000176C000-memory.exe 31 PID 2016 wrote to memory of 1548 2016 3416-0-0x00000000010D0000-0x000000000176C000-memory.exe 31 PID 2016 wrote to memory of 1548 2016 3416-0-0x00000000010D0000-0x000000000176C000-memory.exe 31 PID 2016 wrote to memory of 1548 2016 3416-0-0x00000000010D0000-0x000000000176C000-memory.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3416-0-0x00000000010D0000-0x000000000176C000-memory.exe"C:\Users\Admin\AppData\Local\Temp\3416-0-0x00000000010D0000-0x000000000176C000-memory.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 362⤵
- Program crash
PID:1548
-