Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 18:08
Behavioral task
behavioral1
Sample
b0b3f1cf850721349fe7acfb553e44a864a8bd0214b342cc4cba25bb2091319e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b0b3f1cf850721349fe7acfb553e44a864a8bd0214b342cc4cba25bb2091319e.exe
Resource
win10v2004-20241007-en
General
-
Target
b0b3f1cf850721349fe7acfb553e44a864a8bd0214b342cc4cba25bb2091319e.exe
-
Size
767KB
-
MD5
579828371585f1c6cb5a8fb8a251bd65
-
SHA1
46c2175271baaedd4c8fd8b43d1959a19635d7a1
-
SHA256
b0b3f1cf850721349fe7acfb553e44a864a8bd0214b342cc4cba25bb2091319e
-
SHA512
4acff0519188170d01a42d6e0e156bfd77f6237ae3fc87ef2e3b6095979fcbba9e7191e601ad2bd25e8c256d3bcda704a11ecd14eb01b9755e71ddd48442c787
-
SSDEEP
12288:Fd5WEIwkfQHILFwYrrVTp+ElQca3jCm475XQ8C1c:Fd5WEI7xHrVTp+E+Am4ZBC1c
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\sndrec32.exe b0b3f1cf850721349fe7acfb553e44a864a8bd0214b342cc4cba25bb2091319e.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\WINDOWS\hh.exe b0b3f1cf850721349fe7acfb553e44a864a8bd0214b342cc4cba25bb2091319e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b0b3f1cf850721349fe7acfb553e44a864a8bd0214b342cc4cba25bb2091319e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0b3f1cf850721349fe7acfb553e44a864a8bd0214b342cc4cba25bb2091319e.exe"C:\Users\Admin\AppData\Local\Temp\b0b3f1cf850721349fe7acfb553e44a864a8bd0214b342cc4cba25bb2091319e.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1832