Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
116s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 16:39
Behavioral task
behavioral1
Sample
2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7N.exe
Resource
win7-20240903-en
General
-
Target
2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7N.exe
-
Size
45KB
-
MD5
b7502ae1bf742ff6356e6ff4fcced270
-
SHA1
6e07cfbd80f6055172caf1527bddf14d6cd482fe
-
SHA256
2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7
-
SHA512
f0b5a79063c1d0df7f23548fc8e6a94320f1a8fd21a7d15e15eba2850c04eb15b4d8acd5df03d52ce97a7afcc09c4ba6eaeed6aec49e422b21b837711cfdc279
-
SSDEEP
768:fhP0kDE9N5dCA8J7VHXdrIniQaBTT+QQ+r1n4K8+C9TtIuCjaqUODvJVQ2f:JsWE9N5dFu53dsniQaB/xZ14n7zIF+qr
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\5D41E12C = "C:\\Users\\Admin\\AppData\\Roaming\\5D41E12C\\bin.exe" winver.exe -
resource yara_rule behavioral1/memory/1836-0-0x0000000000400000-0x000000000041D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe 1672 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1672 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1836 wrote to memory of 1672 1836 2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7N.exe 31 PID 1836 wrote to memory of 1672 1836 2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7N.exe 31 PID 1836 wrote to memory of 1672 1836 2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7N.exe 31 PID 1836 wrote to memory of 1672 1836 2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7N.exe 31 PID 1836 wrote to memory of 1672 1836 2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7N.exe 31 PID 1672 wrote to memory of 1284 1672 winver.exe 21 PID 1672 wrote to memory of 1116 1672 winver.exe 19 PID 1672 wrote to memory of 1188 1672 winver.exe 20 PID 1672 wrote to memory of 1284 1672 winver.exe 21 PID 1672 wrote to memory of 916 1672 winver.exe 25
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1188
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7N.exe"C:\Users\Admin\AppData\Local\Temp\2bf898ce7abe16882eac3555e76cdedca62bbfbd3d9870010eaf6258621200b7N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1672
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:916