Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 01:03
Behavioral task
behavioral1
Sample
0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe
Resource
win7-20240903-en
General
-
Target
0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe
-
Size
599KB
-
MD5
9b46500828b338eb4cda1d49bed1f791
-
SHA1
fe2f2d5e222765e585a61f80c33b061f643e7107
-
SHA256
0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9
-
SHA512
5a6e39f1064f7a1db77fe8aab9da039f9340630ecf1379ef28061d857908107ccc884389fdc064d13b5c80fabc417d5d4061a718465f0301e9494c8db109e918
-
SSDEEP
12288:AYV6MorX7qzuC3QHO9FQVHPF51jgcQxNAQ8d6dLOXsGdxpM8E:fBXu9HGaVHdkLO/LE
Malware Config
Signatures
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2220-8-0x0000000001170000-0x00000000012C9000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/2220-0-0x0000000001170000-0x00000000012C9000-memory.dmp upx behavioral1/memory/2220-8-0x0000000001170000-0x00000000012C9000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2220 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe 2220 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2220 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe 2220 0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe"C:\Users\Admin\AppData\Local\Temp\0502e71249410dba419218374909428d7d53cca90c3cfe8861b7f8eae432a4b9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2220