Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:49
Behavioral task
behavioral1
Sample
940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe
Resource
win10v2004-20241007-en
General
-
Target
940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe
-
Size
28KB
-
MD5
2f2f29b1fdc23c208eef50e0d1d7d8da
-
SHA1
38aa1a47e500d98ac17ad711a9009bffb25ecfa4
-
SHA256
940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b
-
SHA512
f4c8cbc0476163a7de0a6156d2da15f649a2e786cca5b79e72d5c9c0ef105af3e90983f0353b800e5d4867059557f5df2f852988f524d6296aadb91980590e8c
-
SSDEEP
384:2/mPAVyp+6srYYCk2gNPapIzFpOQGR9zos2clAKLHRN74u56/R9zZwu9P:J4quFCk2LeXOQ69zbjlAAX5e9zh
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F434E188-6A61-45bf-BCEE-64F7C864C0DB}\stubpath = "C:\\Windows\\{F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe" {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C33F9503-7663-4ccf-A21F-68D6B22BEBE2} {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{C33F9503-7663-4ccf-A21F-68D6B22BEBE2}\stubpath = "C:\\Windows\\{C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe" {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{26A94271-DB8D-48ac-9D07-314CA9684D1E} 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{26A94271-DB8D-48ac-9D07-314CA9684D1E}\stubpath = "C:\\Windows\\{26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe" 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA5C7558-110B-4c6e-80C7-07EA023D5320} {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DA5C7558-110B-4c6e-80C7-07EA023D5320}\stubpath = "C:\\Windows\\{DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe" {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D58E60F1-5111-4ef7-B702-80DA49C9B5FC}\stubpath = "C:\\Windows\\{D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe" {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{35530671-C9F1-4a19-A7A2-180D7DBFA67C}\stubpath = "C:\\Windows\\{35530671-C9F1-4a19-A7A2-180D7DBFA67C}.exe" {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{D58E60F1-5111-4ef7-B702-80DA49C9B5FC} {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F434E188-6A61-45bf-BCEE-64F7C864C0DB} {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{35530671-C9F1-4a19-A7A2-180D7DBFA67C} {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe -
Executes dropped EXE 6 IoCs
pid Process 2748 {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe 2548 {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe 2908 {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe 1576 {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe 1112 {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe 2228 {35530671-C9F1-4a19-A7A2-180D7DBFA67C}.exe -
resource yara_rule behavioral1/memory/2412-0-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/memory/2412-1-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/memory/2412-4-0x00000000002A0000-0x00000000002B2000-memory.dmp upx behavioral1/files/0x0007000000012116-9.dat upx behavioral1/memory/2412-10-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/files/0x0008000000017403-18.dat upx behavioral1/memory/2548-19-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/memory/2748-20-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/files/0x0008000000017409-29.dat upx behavioral1/memory/2548-30-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/files/0x000800000001748f-40.dat upx behavioral1/memory/2908-41-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/files/0x000700000001752f-50.dat upx behavioral1/memory/1576-52-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/files/0x001600000001866d-61.dat upx behavioral1/memory/1112-63-0x0000000000400000-0x0000000000412000-memory.dmp upx -
Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\{F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe File created C:\Windows\{C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe File created C:\Windows\{35530671-C9F1-4a19-A7A2-180D7DBFA67C}.exe {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe File created C:\Windows\{26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe File created C:\Windows\{DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe File created C:\Windows\{D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe -
Program crash 6 IoCs
pid pid_target Process procid_target 2800 2412 WerFault.exe 29 2616 2748 WerFault.exe 30 2904 2548 WerFault.exe 32 1896 2908 WerFault.exe 34 2532 1576 WerFault.exe 37 1848 1112 WerFault.exe 39 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {35530671-C9F1-4a19-A7A2-180D7DBFA67C}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2748 2412 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe 30 PID 2412 wrote to memory of 2748 2412 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe 30 PID 2412 wrote to memory of 2748 2412 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe 30 PID 2412 wrote to memory of 2748 2412 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe 30 PID 2412 wrote to memory of 2800 2412 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe 31 PID 2412 wrote to memory of 2800 2412 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe 31 PID 2412 wrote to memory of 2800 2412 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe 31 PID 2412 wrote to memory of 2800 2412 940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe 31 PID 2748 wrote to memory of 2548 2748 {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe 32 PID 2748 wrote to memory of 2548 2748 {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe 32 PID 2748 wrote to memory of 2548 2748 {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe 32 PID 2748 wrote to memory of 2548 2748 {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe 32 PID 2748 wrote to memory of 2616 2748 {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe 33 PID 2748 wrote to memory of 2616 2748 {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe 33 PID 2748 wrote to memory of 2616 2748 {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe 33 PID 2748 wrote to memory of 2616 2748 {26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe 33 PID 2548 wrote to memory of 2908 2548 {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe 34 PID 2548 wrote to memory of 2908 2548 {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe 34 PID 2548 wrote to memory of 2908 2548 {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe 34 PID 2548 wrote to memory of 2908 2548 {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe 34 PID 2548 wrote to memory of 2904 2548 {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe 35 PID 2548 wrote to memory of 2904 2548 {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe 35 PID 2548 wrote to memory of 2904 2548 {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe 35 PID 2548 wrote to memory of 2904 2548 {DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe 35 PID 2908 wrote to memory of 1576 2908 {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe 37 PID 2908 wrote to memory of 1576 2908 {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe 37 PID 2908 wrote to memory of 1576 2908 {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe 37 PID 2908 wrote to memory of 1576 2908 {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe 37 PID 2908 wrote to memory of 1896 2908 {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe 38 PID 2908 wrote to memory of 1896 2908 {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe 38 PID 2908 wrote to memory of 1896 2908 {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe 38 PID 2908 wrote to memory of 1896 2908 {D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe 38 PID 1576 wrote to memory of 1112 1576 {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe 39 PID 1576 wrote to memory of 1112 1576 {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe 39 PID 1576 wrote to memory of 1112 1576 {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe 39 PID 1576 wrote to memory of 1112 1576 {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe 39 PID 1576 wrote to memory of 2532 1576 {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe 40 PID 1576 wrote to memory of 2532 1576 {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe 40 PID 1576 wrote to memory of 2532 1576 {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe 40 PID 1576 wrote to memory of 2532 1576 {F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe 40 PID 1112 wrote to memory of 2228 1112 {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe 41 PID 1112 wrote to memory of 2228 1112 {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe 41 PID 1112 wrote to memory of 2228 1112 {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe 41 PID 1112 wrote to memory of 2228 1112 {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe 41 PID 1112 wrote to memory of 1848 1112 {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe 42 PID 1112 wrote to memory of 1848 1112 {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe 42 PID 1112 wrote to memory of 1848 1112 {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe 42 PID 1112 wrote to memory of 1848 1112 {C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe"C:\Users\Admin\AppData\Local\Temp\940ed3f46346ea79a3401ae81dd70e513d00c9ab79e9a87e9ac20baedcef659b.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\{26A94271-DB8D-48ac-9D07-314CA9684D1E}.exeC:\Windows\{26A94271-DB8D-48ac-9D07-314CA9684D1E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\{DA5C7558-110B-4c6e-80C7-07EA023D5320}.exeC:\Windows\{DA5C7558-110B-4c6e-80C7-07EA023D5320}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\{D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exeC:\Windows\{D58E60F1-5111-4ef7-B702-80DA49C9B5FC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\{F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exeC:\Windows\{F434E188-6A61-45bf-BCEE-64F7C864C0DB}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\{C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exeC:\Windows\{C33F9503-7663-4ccf-A21F-68D6B22BEBE2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\{35530671-C9F1-4a19-A7A2-180D7DBFA67C}.exeC:\Windows\{35530671-C9F1-4a19-A7A2-180D7DBFA67C}.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 2527⤵
- Program crash
PID:1848
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 2526⤵
- Program crash
PID:2532
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 2525⤵
- Program crash
PID:1896
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 2524⤵
- Program crash
PID:2904
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 2523⤵
- Program crash
PID:2616
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 2522⤵
- Program crash
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD57820d9c4ea6cc293ae243f3c93d00b54
SHA1c33c167b493d900575ad8f4bbd3dc04129d2b8a2
SHA25607cdbd2e375e177ef2d4a3df624d4f58df5cf95be8a6e2a0c94a95740ad70a7a
SHA512e9bce0c117e6300ed84c585891831cb3db647bb3a8ed82bb1a5597e27306ddd0c90c0f863a17bd910acc36b0c430eb849db63b8ce95b7633f34f652efab02664
-
Filesize
28KB
MD5bf818a7879959a13d666b4321933b99e
SHA1b58b92d0577406c5766ae3116c64e7d2d65d6403
SHA2560264c8953dc8d5f63b0d01e9144f7e5c3ccb157a9b8fb6973f8cedea3dbd533b
SHA512b03600a0fe035cfd0db5c28fe3b0ee5e678f22f0e982c8b37fdb606b2936a204233870db6acf12fb586286f0476d533b81b00637c35135082b5767c907d18c4d
-
Filesize
28KB
MD5d11edc8572253f47acf2876d4859a862
SHA13ddf2181ede5892cc78623370c12724bd33e7e4b
SHA2560f0ddd0be512cbd6bf6e90763877013285b29985053741637de9f03b32eae6de
SHA512ea0e3f4bfca87fd61274e546595901ce5207145954a94af221be9983a630d601be611589aa1486d3175ee4655dcbd8a49a9fc9366c7f865e60d0cf90120ada25
-
Filesize
28KB
MD5a798c82a5ae305cf6f953ef0d7c7c262
SHA1670917430fdc209e0ef5fa60c3292b0958da582e
SHA2562ee5a63a3b73ed289372d1a9a41d49199ca58ad5a48513ec8f374dc8556d6530
SHA5124736c96c8f0a9bde21fce51bdd0499b6dfe69efb6d73486feeeb098814ef7a5d2f391c1038487ad38cb0e86e2aa048c76070fd151fe149fbb3efe4806e4b83d4
-
Filesize
28KB
MD59ae118fc6a7526be0dd648cf8a2287f2
SHA1034a32ae28a7caaee1a853c9885451abf52586d5
SHA256a70c9eb0eb701e73c91699baad062916cc110b4ad9af64074e9b9b0aa1652f55
SHA512967e933d78218460a80bbba15e43101999e1d5e2a4d6fbfccbb1039933fafc533f8c98d87bbee7ba6e63c436311b9649ccbc28ead5f2ee417da7a2c6f7284651
-
Filesize
28KB
MD58a3d85e7fb427cb736e95521d0546eab
SHA1074fd133a329c5790ce15a548bc02e65eea93eee
SHA2560ffdfad1dd4e8f224d2ac612fe7bd93ae6c5e156fb984ca632811bce706f46ca
SHA51210f3597a143c6ab4d1211378007dbd7cd64b1e6ce57c6ab55c6bbdbeb1a47c171bb28e2f083182b15748a0dc4416d186ab9b6871ee9520c9fc868699ab52b685