Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/01/2025, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe
Resource
win7-20240903-en
General
-
Target
104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe
-
Size
1.8MB
-
MD5
9d6f20d16ed705822746cc9dddd0651a
-
SHA1
f8a7e04b4218b4e494b3554cca8d4248a9417423
-
SHA256
104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348
-
SHA512
26ba8129439b2578a62ff979e35ed41bda0a11fb23e1f21b8c61ddaae0eba2a9b20168bf0f41c77ad9dfeeebc51dacd45c4a0518a3aab4a41218aa05b687018b
-
SSDEEP
24576:GgubagHj/klIVjvG/jRqcZvwU1mjzxJtujgAx74IgXOeTwGouiA8uZZH9:GfxFYIivRKkN/
Malware Config
Extracted
meduza
127.0.0.1
-
anti_dbg
true
-
anti_vm
true
-
build_name
Meduza
-
extensions
.txt; .doc; .xlsx
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Signatures
-
Meduza Stealer payload 8 IoCs
resource yara_rule behavioral1/memory/1864-11-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/1864-6-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/1864-12-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/1864-5-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/1864-4-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/1864-3-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/1864-10-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza behavioral1/memory/1864-13-0x0000000140000000-0x0000000140141000-memory.dmp family_meduza -
Meduza family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Control Panel\International\Geo\Nation 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2516 set thread context of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1864 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe Token: SeImpersonatePrivilege 1864 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 1864 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 30 PID 2516 wrote to memory of 536 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 31 PID 2516 wrote to memory of 536 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 31 PID 2516 wrote to memory of 536 2516 104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe"C:\Users\Admin\AppData\Local\Temp\104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe"C:\Users\Admin\AppData\Local\Temp\104979f868c8fb59b4536a0dd059e2a85012580611b13005f0551faefd28b348.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2516 -s 362⤵PID:536
-