Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 02:45
Static task
static1
Behavioral task
behavioral1
Sample
2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe
Resource
win10v2004-20241007-en
General
-
Target
2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe
-
Size
225KB
-
MD5
7a121fe6a2c7e10f14720145bbedcbb0
-
SHA1
c5a13fd60ac10ce836c9a5ae5c10baa7df2a5d36
-
SHA256
2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530a
-
SHA512
4012243dfb34237fdc5e5cd295857b87ae5c5bf1783ebe9f65856adbc8e1484bdcfbc399da8e60fc2779767f1b868dc06eaabf067b3ba3d37c8a854d5d7f0f18
-
SSDEEP
6144:6A2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:6ATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\2CC556AB = "C:\\Users\\Admin\\AppData\\Roaming\\2CC556AB\\bin.exe" winver.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe 2264 winver.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2264 winver.exe 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2264 2772 2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe 30 PID 2772 wrote to memory of 2264 2772 2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe 30 PID 2772 wrote to memory of 2264 2772 2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe 30 PID 2772 wrote to memory of 2264 2772 2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe 30 PID 2772 wrote to memory of 2264 2772 2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe 30 PID 2264 wrote to memory of 1212 2264 winver.exe 21 PID 2264 wrote to memory of 1096 2264 winver.exe 19 PID 2264 wrote to memory of 1164 2264 winver.exe 20 PID 2264 wrote to memory of 1212 2264 winver.exe 21 PID 2264 wrote to memory of 1632 2264 winver.exe 25 PID 2264 wrote to memory of 2772 2264 winver.exe 29
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1096
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe"C:\Users\Admin\AppData\Local\Temp\2f5f9c9f15797c49d14d61b9cbb83270333ec1a357c10d37ccc55d7ee7d1530aN.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2264
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1632