Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 06:36
Behavioral task
behavioral1
Sample
b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2N.exe
Resource
win7-20240903-en
General
-
Target
b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2N.exe
-
Size
34KB
-
MD5
449922afcb0756fa3897cbc268c3a8a0
-
SHA1
7fac321ca3f96952c3ec6e6a50cce0f06cb63ae4
-
SHA256
b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2
-
SHA512
81f69cd7e3bdc75156efa19bf4906baa103b260e5da0559cd3efdb26205612dd976ea62d81daed8d13256c74bafe543ed9c83e10619a3d8ecef9fa55c1173f74
-
SSDEEP
768:Mp22qWFcy5XQ7lO41uirwA98p3MpkNBxd0cJWV6dy/x9Ji:MpYoX58z1uirL98xMWnT0OQ9Ji
Malware Config
Signatures
-
Tinba family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\EDCAAFB6 = "C:\\Users\\Admin\\AppData\\Roaming\\EDCAAFB6\\bin.exe" winver.exe -
resource yara_rule behavioral1/memory/2104-0-0x0000000000400000-0x0000000000417000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe 2740 winver.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2740 winver.exe 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2740 2104 b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2N.exe 31 PID 2104 wrote to memory of 2740 2104 b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2N.exe 31 PID 2104 wrote to memory of 2740 2104 b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2N.exe 31 PID 2104 wrote to memory of 2740 2104 b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2N.exe 31 PID 2104 wrote to memory of 2740 2104 b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2N.exe 31 PID 2740 wrote to memory of 1280 2740 winver.exe 21 PID 2740 wrote to memory of 1128 2740 winver.exe 19 PID 2740 wrote to memory of 1236 2740 winver.exe 20 PID 2740 wrote to memory of 1280 2740 winver.exe 21 PID 2740 wrote to memory of 840 2740 winver.exe 25
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1236
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2N.exe"C:\Users\Admin\AppData\Local\Temp\b97c1992b1a0dbbc8cb79dffb905624bd8d9063d35a00a991d7a7f0f97b46eb2N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2740
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:840