Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 18:33
Static task
static1
Behavioral task
behavioral1
Sample
DemonSpoofCall.exe
Resource
win7-20240903-en
General
-
Target
DemonSpoofCall.exe
-
Size
9.7MB
-
MD5
1dfe6d227d66658b9ab790ce66160551
-
SHA1
62087a4f6c0b47635f068262b3d9df15aab746d9
-
SHA256
c2d4aff226178355b8ef7b9e28e4d2869def12eacdfe91e9ed1135b6cd20deab
-
SHA512
c10e34658ea727c52f96051fd9fe6d3c1b6f3dbeed9b9ced6bbfd2819db3a8aaeea693f890581190d3d10749e3000f8088c543d8cd006301c0b3032c4457d454
-
SSDEEP
196608:lrkCDFxgtiWe4/RSgOqTn9nBIzuZrSW+xHGoFlaoDKWzQo1OIg5sa7t:5eiYRNXnDZrSF8oF9uB5B
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com 6 raw.githubusercontent.com -
Program crash 1 IoCs
pid pid_target Process procid_target 320 1984 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DemonSpoofCall.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1984 DemonSpoofCall.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1984 DemonSpoofCall.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 320 1984 DemonSpoofCall.exe 31 PID 1984 wrote to memory of 320 1984 DemonSpoofCall.exe 31 PID 1984 wrote to memory of 320 1984 DemonSpoofCall.exe 31 PID 1984 wrote to memory of 320 1984 DemonSpoofCall.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\DemonSpoofCall.exe"C:\Users\Admin\AppData\Local\Temp\DemonSpoofCall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 17202⤵
- Program crash
PID:320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf9aa085769296c0ee2aeb78ddf0dede
SHA1e6e98be873818689a67762b64eb5aecb716ad064
SHA25606a72c65091cf4d2b8e9e8a2b7959ddb9a6fce71871611f30c6f0b027207dd48
SHA5120373e21e0c094c07caca4b5bb67be3ab02ef4acffeff3fb593af4499812368e672b019a75cb2560a8fa61113e9b4e573138cde7e108b10abfadb012fe3089e46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557685d05b13a1fd6228af6323154dd42
SHA18b5526c5f7d21575689a9afc171c499166458e8f
SHA256bab45b6b73de2c60764fbf1f9f968d7241cdedd37bea92a27a8e9aaf07c99765
SHA512e43ff44b9f134627b0dad1b51afa5c771c86ade46bdc51f5bab6b3de3d253ba6ce5e948c98012585fe6437879ab4fa615ff8a2bce93fd4283f6733777242abdc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b