Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 16:25
Behavioral task
behavioral1
Sample
552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe
Resource
win7-20240729-en
General
-
Target
552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe
-
Size
2.3MB
-
MD5
bc055ee1a3e93a1f1cadb666d073aa39
-
SHA1
3a0d99190c69380ce01a088d7b8850debe4cf0f8
-
SHA256
552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752
-
SHA512
e77c8e75f9b1bce8136ebdb1807915f81c37d80f03e29b55cde6ee3c1755484b312254f86264ccc7dac54e65d68e4a7a4987b615af1b0f9fd2c986d6c3a36988
-
SSDEEP
24576:3qzIIUgC8d36kLBXlnB8j7v5Ta+hLLQ20JmXSeWwa1oWJQjk0svTS/PPsbb1hwRn:3sCOfN6X5tLLQTg20ITS/PPs/1kS4eW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 4 IoCs
resource yara_rule behavioral1/memory/2384-0-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/files/0x000b0000000122cf-5.dat family_blackmoon behavioral1/memory/2384-6-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2528-8-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 1 IoCs
pid Process 2528 vvjpj.exe -
resource yara_rule behavioral1/memory/2384-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x000b0000000122cf-5.dat upx behavioral1/memory/2384-6-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2528-8-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2392 2528 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2528 2384 552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe 30 PID 2384 wrote to memory of 2528 2384 552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe 30 PID 2384 wrote to memory of 2528 2384 552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe 30 PID 2384 wrote to memory of 2528 2384 552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe 30 PID 2528 wrote to memory of 2392 2528 vvjpj.exe 31 PID 2528 wrote to memory of 2392 2528 vvjpj.exe 31 PID 2528 wrote to memory of 2392 2528 vvjpj.exe 31 PID 2528 wrote to memory of 2392 2528 vvjpj.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe"C:\Users\Admin\AppData\Local\Temp\552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\vvjpj.exec:\vvjpj.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 363⤵
- Program crash
PID:2392
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD5d7a15c41c29e76af1f998c0f53f517fc
SHA1c1cc6ca8a5c5eaa63bc9191f2457e0b13e46c6b4
SHA25698e27dd35ad91a3d009cf2f0982347664ea12470e08e4577102e7f65c9db79da
SHA512987c770f403b0d89de0c8abe750f33d38685614fe40fe9e2cda485dd3341b543347e645e420d04e18ada4c561bd4adcd1ecf22230f9fce0cbc6b7b823c5bc325