Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
OP53532 Harumi new order.scr.exe
Resource
win7-20240903-en
General
-
Target
OP53532 Harumi new order.scr.exe
-
Size
217KB
-
MD5
ca2cb33b0542cdba0673c3f0a81a2f7f
-
SHA1
066c0fc9236c6eb5ad69a3f8f095a793a9d5789a
-
SHA256
f3ff932bd931ee266567cd0422a067fd38281164c534026b57d740658aa056c3
-
SHA512
377d2222e3083e07ebf8b19eacf2ce3cb9222ee93c240a6a150c5e2a76a09770a7887e0a65a8cc02902e12da0adcb985d787bcc00b6fb5bb2ca8ed7647d2606d
-
SSDEEP
6144:/Akza3r9r/EDpppppppppppppppppppppppppppppL9:Be3r9r/+pppppppppppppppppppppppd
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs OP53532 Harumi new order.scr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4796 2096 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OP53532 Harumi new order.scr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4696 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2096 OP53532 Harumi new order.scr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2096 OP53532 Harumi new order.scr.exe Token: SeDebugPrivilege 2096 OP53532 Harumi new order.scr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2096 wrote to memory of 4668 2096 OP53532 Harumi new order.scr.exe 31 PID 2096 wrote to memory of 4668 2096 OP53532 Harumi new order.scr.exe 31 PID 2096 wrote to memory of 4668 2096 OP53532 Harumi new order.scr.exe 31 PID 2096 wrote to memory of 4668 2096 OP53532 Harumi new order.scr.exe 31 PID 4668 wrote to memory of 4696 4668 cmd.exe 33 PID 4668 wrote to memory of 4696 4668 cmd.exe 33 PID 4668 wrote to memory of 4696 4668 cmd.exe 33 PID 4668 wrote to memory of 4696 4668 cmd.exe 33 PID 2096 wrote to memory of 4796 2096 OP53532 Harumi new order.scr.exe 34 PID 2096 wrote to memory of 4796 2096 OP53532 Harumi new order.scr.exe 34 PID 2096 wrote to memory of 4796 2096 OP53532 Harumi new order.scr.exe 34 PID 2096 wrote to memory of 4796 2096 OP53532 Harumi new order.scr.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\OP53532 Harumi new order.scr.exe"C:\Users\Admin\AppData\Local\Temp\OP53532 Harumi new order.scr.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:4696
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 12122⤵
- Program crash
PID:4796
-