Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/12/2024, 15:29
Behavioral task
behavioral1
Sample
2476-0-0x00000000015E0000-0x0000000001C75000-memory.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2476-0-0x00000000015E0000-0x0000000001C75000-memory.exe
Resource
win10v2004-20241007-en
General
-
Target
2476-0-0x00000000015E0000-0x0000000001C75000-memory.exe
-
Size
6.6MB
-
MD5
98db604fb4ada4fa212eee3cb179713b
-
SHA1
ae9d47d445574350ac870d123e55230137e8c340
-
SHA256
0bf6ae11030acfd8498a51843366b153f478d2ae9d3505f3cd54ce1d07cc1516
-
SHA512
65c1d7d6776ebb4766d9a47a11f3bf3a89fefb6aac90bbf334d05b8172b812ea02d05f0d3d364affb8db8b134bd097bf819ff39acb2b9f8df68045f3edadab48
-
SSDEEP
3072:eblUsHGa58CS9yDcrGKDlvf6CzOmEnNiQPyCbYmPUK+v+Q98XUl:ibl5UyDcriCqmEncUjMmPIvzqe
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3628 4508 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2476-0-0x00000000015E0000-0x0000000001C75000-memory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2476-0-0x00000000015E0000-0x0000000001C75000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2476-0-0x00000000015E0000-0x0000000001C75000-memory.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 2242⤵
- Program crash
PID:3628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4508 -ip 45081⤵PID:1744