Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/01/2025, 07:02
Behavioral task
behavioral1
Sample
e3fd8ca4874f45f60b922794a956c9ea8281f748da3959e8131f762af63a1616.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
e3fd8ca4874f45f60b922794a956c9ea8281f748da3959e8131f762af63a1616.exe
Resource
win10v2004-20241007-en
General
-
Target
e3fd8ca4874f45f60b922794a956c9ea8281f748da3959e8131f762af63a1616.exe
-
Size
482KB
-
MD5
79341dbc13c02100fb9ec2ffa8a5e011
-
SHA1
87798cd51faf3996967d8cc377b14eed828d9595
-
SHA256
e3fd8ca4874f45f60b922794a956c9ea8281f748da3959e8131f762af63a1616
-
SHA512
695348d66c2bedc753344de0a59bb8fc05dbfdb2c52f9cdbb392d6ad37109a70ead8f4fd8cb2b3151174616eaaa64981ece3694f1c1f17ed34d2b87fa79cd224
-
SSDEEP
12288:x13ak/mBXTG4/1v08KI7ZnMEF76JqmsvZQES:jak/mBXTV/R0nEF76gFZH
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e3fd8ca4874f45f60b922794a956c9ea8281f748da3959e8131f762af63a1616.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3204 e3fd8ca4874f45f60b922794a956c9ea8281f748da3959e8131f762af63a1616.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3fd8ca4874f45f60b922794a956c9ea8281f748da3959e8131f762af63a1616.exe"C:\Users\Admin\AppData\Local\Temp\e3fd8ca4874f45f60b922794a956c9ea8281f748da3959e8131f762af63a1616.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5d4a3bc529138c796c7784e34771a3ebb
SHA1d34b1b9e26f97b540132de25c5e8a4cce10dd466
SHA256b245333ef679313f4c2b786e67f3e5622e175e42395b82a75b4127ba8898e0a5
SHA512798ea235fec3a928e335f106bf39101ee9a8938b0afbf689b4609e1182562a12cdf8f0fbc5af4705e4fa6e33e9f3d45f3ead24ed1406c0d304c934ff866b7e66