Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 02:39 UTC
Static task
static1
Behavioral task
behavioral1
Sample
97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe
Resource
win10v2004-20241007-en
General
-
Target
97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe
-
Size
237KB
-
MD5
29bb78fa90102178222f44f3356a9a43
-
SHA1
23dd6a29c1ba2c5f88a25cfdb977758d4c5bde84
-
SHA256
97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8
-
SHA512
3f48d25c2fe762e8b1648c454b6c97c8ef9010ecdd73e56d9fa8a4f3ee85b907abb2419dc539da6eed1218edf6d12ab1784ea796a17b888180475a6df3a008f7
-
SSDEEP
6144:uA2P27yTAnKGw0hjFhSR/W1nyAJ9v0pMtRCpYw:uATuTAnKGwUAWVycQqgb
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\9FA8544E = "C:\\Users\\Admin\\AppData\\Roaming\\9FA8544E\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe 2756 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2756 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2756 2332 97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe 31 PID 2332 wrote to memory of 2756 2332 97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe 31 PID 2332 wrote to memory of 2756 2332 97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe 31 PID 2332 wrote to memory of 2756 2332 97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe 31 PID 2332 wrote to memory of 2756 2332 97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe 31 PID 2756 wrote to memory of 1368 2756 winver.exe 21 PID 2756 wrote to memory of 1204 2756 winver.exe 19 PID 2756 wrote to memory of 1312 2756 winver.exe 20 PID 2756 wrote to memory of 1368 2756 winver.exe 21 PID 2756 wrote to memory of 620 2756 winver.exe 23
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1204
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1312
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe"C:\Users\Admin\AppData\Local\Temp\97ae880de1028c35663bb5e82d7d1a2f1094a0dd1ab555ecfbc9c3ade776e6c8.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2756
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:620
Network
-
Remote address:8.8.8.8:53Requestelitiorecfreetoo.ccIN AResponseelitiorecfreetoo.ccIN A216.218.185.162
-
Remote address:216.218.185.162:80RequestPOST /el0hjkd76ghs65dhj0it/ HTTP/1.0
Host: elitiorecfreetoo.cc
Content-Length: 157
ResponseHTTP/1.1 200 OK
Date: Tue, 31 Dec 2024 02:40:38 GMT
Content-Type: application/octet-stream
Connection: close
-
1.1kB 920 B 18 19
HTTP Request
POST http://elitiorecfreetoo.cc/el0hjkd76ghs65dhj0it/HTTP Response
200