Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 21:45
Behavioral task
behavioral1
Sample
694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6.exe
Resource
win7-20241010-en
General
-
Target
694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6.exe
-
Size
44KB
-
MD5
0542abbf4c34bbff628ba9d0c3739405
-
SHA1
01561008ac53c3ce129ea913f8709eb95477acb7
-
SHA256
694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6
-
SHA512
0f26da01613ab47352bca5db03c12432287295d15fe170c4a9c7887b2f1dbb436d543392c4b5ed23a2881307bd1122c9b8c41982ac92b4f192542634475140e9
-
SSDEEP
768:Ra+vOyMD5oQ/cXK+dbFg1TGAN2RUqZxbhxEll7j0MLlH:Ra+vM4ld+TR26qZxbhO3IM
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\7A311455 = "C:\\Users\\Admin\\AppData\\Roaming\\7A311455\\bin.exe" winver.exe -
resource yara_rule behavioral1/memory/2728-0-0x0000000000400000-0x000000000041A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe 2844 winver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2844 winver.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2844 2728 694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6.exe 31 PID 2728 wrote to memory of 2844 2728 694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6.exe 31 PID 2728 wrote to memory of 2844 2728 694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6.exe 31 PID 2728 wrote to memory of 2844 2728 694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6.exe 31 PID 2728 wrote to memory of 2844 2728 694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6.exe 31 PID 2844 wrote to memory of 1204 2844 winver.exe 21 PID 2844 wrote to memory of 1096 2844 winver.exe 19 PID 2844 wrote to memory of 1164 2844 winver.exe 20 PID 2844 wrote to memory of 1204 2844 winver.exe 21 PID 2844 wrote to memory of 1508 2844 winver.exe 25
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1096
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6.exe"C:\Users\Admin\AppData\Local\Temp\694decb30226b8e3da044ce0ad963bbeff1af9af4a94c0527a954de6cbd08da6.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2844
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1508