Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 16:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Payment013125.exe
Resource
win7-20240903-en
5 signatures
150 seconds
General
-
Target
Payment013125.exe
-
Size
1.1MB
-
MD5
1f25b0932adb4f999664456718bd2705
-
SHA1
65b93e7c15c644f81784b38f68e832ef09f39a3a
-
SHA256
cdb3229e64d90c75e9205357001b037333e36ecf141098dab1971d82cfa238ee
-
SHA512
1aa055a35277b77db20b87c604eea433ad78fe2f3ffd1199e9ab89788cea6f53e39219d227536787c14ff268c500e43fb393e623c04c7c7e520a80adc0ab595d
-
SSDEEP
24576:lPV8K/0GHMcdgApDHFJGHSjbsZrnhuoBiq1D4Bu5JdQLaP:4KMPcdfOyjbsZ7cosqxwuPN
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4704 2820 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payment013125.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2820 Payment013125.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2820 Payment013125.exe Token: SeDebugPrivilege 2820 Payment013125.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2820 wrote to memory of 4704 2820 Payment013125.exe 30 PID 2820 wrote to memory of 4704 2820 Payment013125.exe 30 PID 2820 wrote to memory of 4704 2820 Payment013125.exe 30 PID 2820 wrote to memory of 4704 2820 Payment013125.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment013125.exe"C:\Users\Admin\AppData\Local\Temp\Payment013125.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 6162⤵
- Program crash
PID:4704
-