Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe
Resource
win10v2004-20241007-en
General
-
Target
59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe
-
Size
225KB
-
MD5
88d48dd7a733c1d0907d756433e5a990
-
SHA1
5b4cd5003a79ca9198ef798bedb021bc4b547bff
-
SHA256
59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4f
-
SHA512
f67fbe4446a3e106f4322aab3cbae8a4fb4565eaf00e016b5e9f1136c733f39c9df5f242fd23dd8a01f0acefb8d5f332b2ca178b34a554af3be966bd68542a22
-
SSDEEP
6144:UA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpY0:UATuTAnKGwUAW3ycQqgF
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\BC3157B9 = "C:\\Users\\Admin\\AppData\\Roaming\\BC3157B9\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2756 winver.exe 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2756 2372 59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe 31 PID 2372 wrote to memory of 2756 2372 59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe 31 PID 2372 wrote to memory of 2756 2372 59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe 31 PID 2372 wrote to memory of 2756 2372 59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe 31 PID 2372 wrote to memory of 2756 2372 59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe 31 PID 2756 wrote to memory of 1196 2756 winver.exe 21 PID 2756 wrote to memory of 1108 2756 winver.exe 19 PID 2756 wrote to memory of 1172 2756 winver.exe 20 PID 2756 wrote to memory of 1196 2756 winver.exe 21 PID 2756 wrote to memory of 1636 2756 winver.exe 25 PID 2756 wrote to memory of 2372 2756 winver.exe 30
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe"C:\Users\Admin\AppData\Local\Temp\59ef016b1f4c06236c19ccb8d54c6d678a8aa8ec2793b09c13bc5b9ff4f0dc4fN.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2756
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1636