Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2025, 07:48
Static task
static1
Behavioral task
behavioral1
Sample
2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe
Resource
win10v2004-20241007-en
General
-
Target
2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe
-
Size
1.0MB
-
MD5
bd02464d75221ac0da2289e15fca49c9
-
SHA1
0049673eddb7689c594d0dceea9cefb56b1d1ab0
-
SHA256
2e9a793c02aae5b3dd4119d9ffa2a57437d9b00d3d931aeb89ede5c65faf2610
-
SHA512
50c37d80b9753b92f7375d5c6a1f4115bebeefd9629982fb7de7b1315d5c41bc141bae5f56de0b4b8bace7428fc56770b8ecb0b47f43e63cefcdf45447e2c9bc
-
SSDEEP
24576:YAHnh+eWsN3skA4RV1Hom2KXMmHaTfNuuQ7L1g5:fh+ZkldoPK8YaTfBQ7L4
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3256 1684 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1684 2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe 1684 2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1684 2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe 1684 2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1684 2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe 1684 2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2664 1684 2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe 83 PID 1684 wrote to memory of 2664 1684 2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe 83 PID 1684 wrote to memory of 2664 1684 2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe"C:\Users\Admin\AppData\Local\Temp\2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\2E9A793C02AAE5B3DD4119D9FFA2A57437D9B00D3D931AEB89EDE5C65FAF2610.exe"2⤵PID:2664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 6922⤵
- Program crash
PID:3256
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1684 -ip 16841⤵PID:3424