Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe
Resource
win10v2004-20241007-en
General
-
Target
fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe
-
Size
5.3MB
-
MD5
0a269c555e15783351e02629502bf141
-
SHA1
8fefa361e9b5bce4af0090093f51bcd02892b25d
-
SHA256
fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca
-
SHA512
b1784109f01d004f2f618e91695fc4ab9e64989cdedc39941cb1a4e7fed9032e096190269f3baefa590cc98552af5824d0f447a03213e4ae07cf55214758725a
-
SSDEEP
98304:Uc9HTcGO0ImBimas54Ub5ixTStxZi/l9K0+zLVasSe4JnzMpm+Gq:UcpYGO0IOqs57bUwxG9CVaskJIYE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe Key value queried \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\International\Geo\Nation fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe -
Loads dropped DLL 2 IoCs
pid Process 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 2020 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 2160 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2020 1736 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 30 PID 1736 wrote to memory of 2020 1736 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 30 PID 1736 wrote to memory of 2020 1736 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 30 PID 1736 wrote to memory of 2020 1736 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 30 PID 1736 wrote to memory of 2160 1736 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 31 PID 1736 wrote to memory of 2160 1736 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 31 PID 1736 wrote to memory of 2160 1736 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 31 PID 1736 wrote to memory of 2160 1736 fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe"C:\Users\Admin\AppData\Local\Temp\fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe"C:\Users\Admin\AppData\Local\Temp\fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe" --local-service2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe"C:\Users\Admin\AppData\Local\Temp\fff4b96876b0c78da96e57cf7ca1b0e0cbee4fde52047a9bde52e25b062d69ca.exe" --local-control2⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5ecb9969b560eabbf7894b287d110eb4c
SHA1783ded8c10cc919402a665c0702d6120405cee5d
SHA256eb8ba080d7b2b98d9c451fbf3a43634491b1fbb563dbbfbc878cbfd728558ea6
SHA512d86faac12f13fcb9570dff01df0ba910946a33eff1c1b1e48fb4b17b0fb61dded6abf018574ac8f3e36b9cf11ec025b2f56bb04dd00084df243e6d9d32770942
-
Filesize
4KB
MD55f56302b24d5a132a733861803b079eb
SHA10e171bad47eaf99290e13e707fb689d350491252
SHA256014958e79d21fe8b1981e60d7e134f4a668f0595ae25651c85f1b64160ceb577
SHA512e78854fc92a43130b9f65302b678c666d903e18046ccf7502906e935263ed51b6b3cbb3f72be1a74c63d43682e2327e0c1ba5939b40c673235fefc7faf0da464
-
Filesize
9KB
MD57426d9a7c4bccd9aa1ebc48958fb2b7e
SHA1124b7ab84d66cc0a0f0c6fe6edbed382cbfd6b08
SHA25686f60a8128b0dc692554baeb8459a1873f86c5b46e27eac9cb3038b7ad7b5c56
SHA512de2912da2d4c75e3cb5e190db2b4ec4ced22c757e247a501230080a7686a0bea976fdc7bd1c70e9424cb1be2cdae25f3e92ae33614a86a01e0db3524061ba2e8
-
Filesize
2KB
MD5981002fe5d085456b5e99b0c165f5d2c
SHA1d265024ac6df8425f5cc4b90d437b35971275282
SHA25627d45ff5116c89dfb312ff2eb0edcce481c03c9b42575e9a7db5a321b2d89034
SHA5121071487ba36786bcb4273b05975424be90b769618801f5c88af350a45a33d4d46bf7617c453031c6b0fa09623dcd3b2e91913f414f84cb9976c1df7bb812dfad
-
Filesize
2KB
MD54423fa6c3c68062638bdabee90624e04
SHA1f7246004249419e40eb8838fb38e0efd7947edb9
SHA256f514cf70dc43c1677e28c963152149d4bfc7f5e8932daed9c632a35be2a1adf0
SHA512d4d9e482af244617b4e34e2eb2432b5de56667fd8030df6036f70af16f97352178209b26f7b3cce714c5fa7c0bb0dc215fe02dd8227b9cc454c967ee0047c4d1
-
Filesize
766B
MD54c8ee43dfb4f195d0b727b28f4949080
SHA1ad8f62fb8b46f8dc13dd6fea58daaade74d30a92
SHA2562e5bbf73fc6869b4d4ca2fa56ea25977bd3508cfb7ef98b10e2fc5b25c3062a8
SHA5123e2384b442e2f69515f06b8515cef817096b52dcefcee2a8e69e0396a8d815cde31dae7065c61eb6b20f8363a672b3489cfedcdfd8a5a9ee0df8b8ef9ca63580
-
Filesize
832B
MD5583f2f5a13ffa87918ecca64228da260
SHA1878347d1bc48b9ae8084d64d91f4433c45329041
SHA256a5507f3858a909bda42ef9730c6ecfef853d1e2444c999676b9adffe0ff040ac
SHA5126b663c2773c98cd7c64f275fe60e58a3be2062e5f6279cdd92a36f126a9385d112491d8666ab2309e14cedb6dcc09f833f3c7368956a176a2006be43099680fc
-
Filesize
312B
MD50c04ad1083dc5c7c45e3ee2cd344ae38
SHA1f1cf190f8ca93000e56d49732e9e827e2554c46f
SHA2566452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0
SHA5126c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492
-
Filesize
468B
MD5a39b5f52eab7b3234d7a65c53199493b
SHA137bf241350d818f6a53464ed8efb8167e1774ff0
SHA256cd342b023e71b8a77ee7a2579b7298cdd651d00bf2df03b368320ce86797d741
SHA512fcd75fa0058675d85457e545fc9e45c79269bbd77e08b09970fa3e488273eb0eb69b5640a13575c5138e4816731a21a918244a5d5a16d5811d233406722ffa8a
-
Filesize
468B
MD5658ac39df832f992a43c243596b8914c
SHA15f01dba2a8639acaa30fc3df7470863b233ba053
SHA2567f7fd1611033e16425b0eafcfe1f5bd2b01ff8283a159a6b3a4e7a5448fe2d2b
SHA5121182fab154f2b0ea19b2e8d1c1795ba39c939550a3287c55522cf4cb57e354ba099dc871267c5ff0dc83140c69a051a1b122c55f8cda8fca1fb3bb6e3b319031
-
Filesize
2KB
MD5fe2ed8b89df21b916ce85ca60ff48c21
SHA1ae5d09116b0d44099d1c4427d111f1655444a84d
SHA256caf49a7b617e64d88cf463e7ba0c5969259ab9906be59b02ad2a4dc297a87f05
SHA512b675edef19c2213473c58f200c0e7cb67c912a7d931b9e958114da69b7ddc448e38c29d8132c81fc08ec779ada7e58136411cbd139732af0fcef156d8a74df17
-
Filesize
2KB
MD500d3c3410167f9d2b5535b8a8e6365c1
SHA1eb497a6fd4611c75840f15d885ecdcef36c5f7a9
SHA2567a8b1ec4ad7e8ca3abb8f76bf511d64a0008935344a94c7c9631d7b54c63feac
SHA512818d96481f10b429d13ca853f9cd94b4ffab137fb19d587838618c1b8aa599018f1253ece763fd9e6908b93e2c68d74379985bea023afde0bb2319930fd841a8
-
Filesize
2KB
MD5512cf4603552d82d3cdc2ef5d1957cbc
SHA1597358fb5571f4b03e4e90f3d989ca0d572573d5
SHA256b307204528a786c9d24b25244e62f611d48a30ffcc5e783b357abd62c7b8e4d1
SHA512ba7e54cec98972b230e4fcec8c47020f10e0abd55dfec52c73aa2c10a64205987c351fdd43abe86e3072e9467b1e9aba7de199a7818acd37ff7794b5e007161b
-
Filesize
2KB
MD58bc7859c489990f95cd577979e253f28
SHA1b02a48ab470cddd9b21f6a8980112b437c34c793
SHA2561df5eb6917448bc36655723ff65eabce51b6ede8a1a567f0dceb061143b250af
SHA51293727d52664d613672d6147923797a99b2a93b95ae039258484542f6f6d3c72d0f8b1394aea993181d8c312393aa5f39ca5377ca2fe322568de5075fc81e84cb
-
Filesize
6KB
MD506bd0560bc414a4600dc88a4fbbf3c12
SHA10796a0237a010d97bffecb9196a863b05f0eb089
SHA2565ff98265c4d6b5b5a7087e04aefa3c7be68f7b5ecd04d98886c7c74dd96694fd
SHA512907e10fb109cab88f8934890add71647c3f54603e497a5d5b6c973362de8a3e09b663ef9f54838a40a0ebc4828814c8c9250d171495fcb0c528dc8d1dd465fee
-
Filesize
6KB
MD59bf75c32ba2ddfb40665e76ab6e9f84d
SHA17ae12fc53d6a6192189050e81714de202ef3185b
SHA2569fed26a06805f33e3ed5157c548996898bb30e4cf7f22611584efc1d3598fa78
SHA512cb01bcee62fc8c73926b3edb5e84fa91dddd128473a06d1355293759f216429648c8eea7f4beee6fb1ece24bda27515e10e82d7d6cb57297ced3002634973c1c
-
Filesize
6KB
MD59d2d94c42e89b855eb79a3134cfc272a
SHA1e81f090516517cc4b4cb5e8bff47cd1770a0aa40
SHA25639cec74440424d9cd59d1b922aab25011be921eff37e104f8c52f0906baa0a7c
SHA512ae609bdf922f1bf2a4a35c10ec3f27d3680c8058afb321077e81848cd10cbefabfd81cfdd7acbeaed156c4d419dfc4d52a777880ec044459960485c769b9609b
-
Filesize
6KB
MD50c661e30e038b1563ddf8bb8af55c04e
SHA154146a10bc8cce4870e7b172f75697297a0896c7
SHA2565226c8be2d167570aecb8618fa12f2d110d940ca7cfae91b7b654db142545b57
SHA512f4190fa7ba22708ac464b293d5c5fca5dcfaf9cb5c80370a89bfbeed21859561cfc3c79ec62fba3505dbeea01d2a301aa1ec97824e8dc2433f2c443b4464802d
-
Filesize
6KB
MD553e98ab8b59499661c2cf7e1d50bbfbc
SHA162ea1a64b424e85090c6fabaad0e1cb20d8be92d
SHA256f348ca9f88626df3ab436124c6c7bed29aa3d662e1a2cc71836288e78b7449b2
SHA512f0b13719ea12e9b17d42fcef2b067d2d9abac0d736bce48617ece80a16151042caa0226c6346213bc6043c43eca64f8baac0597a1a49b85f0208929aec0463ef
-
Filesize
1KB
MD5a103f4d3beb63e2fa97a136fc2ba6bd8
SHA142bb4b3ae0fba1f080b4b618af72a005e21f1d79
SHA25615b009135b64525b21125853075fe199a84b3e3b0c9d2d43fb6c58fdab2c2d03
SHA512701457090f0dc48583987bc2d9562ed2d13211c90f0490646f478c072e770a274a8d5a7108476c7a586fb04ae6baf10014af3d665e329e91e0ebadffa807b512
-
Filesize
1KB
MD5c949fcfd43b4f1d4422956a9a1e5a723
SHA1a73523486746016f1017cc4526ec08bb3628d851
SHA2560c8116cee6ae5a55d4ab54cd4dd33bbc7a6bdf7f8d81c729d3e2048d1a948a45
SHA512215e0fcd3dbb7b21c20e82d4769610389bbe07cdfe3cd06a5f40aaff8ef02eaf4f1dfe3c4ab3d32c6f2b52dcf08937d79090a5cfb14a40c549c3cbf18c507818
-
Filesize
1KB
MD54750a6b3fa1f6d3e4067eb553cb18008
SHA197ad5d94b64cbfb033a64626f578d3bff96390b2
SHA25663e80bb257bc9872a9a57e76a8ecce865878774d72f9660d96c75fc85c701ac8
SHA512958b51385a99fcb288e89f0333df63f9f496b67b56dc95cee7cb1965e616a5d5521bd1423b8402a651555b650b3c02f691e3fa8ebbd72786c383670477dfcaed
-
Filesize
1KB
MD506eb5f6a80ff155119db08486433e853
SHA1e805143d824756eae73fdbc59e8b9a86c417870a
SHA256f941c227473cfdbcb01b64cce6632d9f606431551f60d96eadd9c76973ed8b59
SHA512c062bb84578ef311fe1e117c36b3415d32af66301808ea33a04ae654a28cf459e0fb3692299ea1c19482dc897a84382334bb55d765a45cefe868899f1693dfb7
-
Filesize
385KB
MD51ce7d5a1566c8c449d0f6772a8c27900
SHA160854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA25673170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
SHA5127e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753