Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10virussign....50.exe
windows7-x64
7virussign....50.exe
windows10-2004-x64
7virussign....77.exe
windows7-x64
7virussign....77.exe
windows10-2004-x64
7virussign....f2.dll
windows7-x64
1virussign....f2.dll
windows10-2004-x64
1virussign....1f.exe
windows7-x64
10virussign....1f.exe
windows10-2004-x64
10virussign....cd.exe
windows7-x64
7virussign....cd.exe
windows10-2004-x64
7virussign....e8.exe
windows7-x64
5virussign....e8.exe
windows10-2004-x64
5virussign....b9.exe
windows7-x64
5virussign....b9.exe
windows10-2004-x64
5virussign....61.exe
windows7-x64
5virussign....61.exe
windows10-2004-x64
5virussign....94.exe
windows7-x64
5virussign....94.exe
windows10-2004-x64
5virussign....9f.exe
windows7-x64
10virussign....9f.exe
windows10-2004-x64
10virussign....b3.exe
windows7-x64
10virussign....b3.exe
windows10-2004-x64
10virussign....93.exe
windows7-x64
7virussign....93.exe
windows10-2004-x64
7virussign....8a.jar
windows7-x64
1virussign....8a.jar
windows10-2004-x64
1virussign....32.exe
windows7-x64
7virussign....32.exe
windows10-2004-x64
7virussign....02.exe
windows7-x64
5virussign....02.exe
windows10-2004-x64
5virussign....07.exe
windows7-x64
1virussign....07.exe
windows10-2004-x64
3Analysis
-
max time kernel
92s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 18:47
Behavioral task
behavioral1
Sample
virussign.com_e9db7f543abe55498e2fe9e81adbd150.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
virussign.com_e9db7f543abe55498e2fe9e81adbd150.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
virussign.com_eaaf615aa5e8154699b86613ef98de77.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
virussign.com_eaaf615aa5e8154699b86613ef98de77.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
virussign.com_eb1164afcd72b42faf1ed16fe69415f2.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
virussign.com_eb1164afcd72b42faf1ed16fe69415f2.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
virussign.com_eb1a20a14bfd42ddd3c295062ff4c91f.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
virussign.com_eb1a20a14bfd42ddd3c295062ff4c91f.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
virussign.com_ec6cca2542808661cbc8b554736f52e8.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
virussign.com_ec6cca2542808661cbc8b554736f52e8.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
virussign.com_ecb767dd467a854cb9068795c708edb9.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
virussign.com_ecb767dd467a854cb9068795c708edb9.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral15
Sample
virussign.com_ecc04a1ce003b4a5edb12825179f3a61.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
virussign.com_ecc04a1ce003b4a5edb12825179f3a61.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral17
Sample
virussign.com_ed168bd396c4fdc03053f5b02fcf6994.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
virussign.com_ed168bd396c4fdc03053f5b02fcf6994.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral19
Sample
virussign.com_edbc11f0b4f0a9f3964923415573569f.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
virussign.com_edbc11f0b4f0a9f3964923415573569f.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral21
Sample
virussign.com_eec6bc403630659c6ed893e51572f6b3.exe
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
virussign.com_eec6bc403630659c6ed893e51572f6b3.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral23
Sample
virussign.com_eef74eda1855b3cf10300926cc0e0693.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
virussign.com_eef74eda1855b3cf10300926cc0e0693.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
virussign.com_f0b6e9f132c0d0549c401fe8943b708a.jar
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
virussign.com_f0b6e9f132c0d0549c401fe8943b708a.jar
Resource
win10v2004-20250129-en
Behavioral task
behavioral27
Sample
virussign.com_f0d49bace28a764cdbca55aafbd5da32.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
virussign.com_f0d49bace28a764cdbca55aafbd5da32.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral29
Sample
virussign.com_f201c60260bf5daf402404b095776202.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
virussign.com_f201c60260bf5daf402404b095776202.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral31
Sample
virussign.com_f34196caf20b1d0c9aca4ecca9fca907.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
virussign.com_f34196caf20b1d0c9aca4ecca9fca907.exe
Resource
win10v2004-20250129-en
General
-
Target
virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe
-
Size
960KB
-
MD5
eb4dc797b31871c193bd57e75feda4cd
-
SHA1
6bbf67fdd8afb7169029c380759ed466bc6a9c6e
-
SHA256
6df068e0c186d1dcfbe22e568f0ae287f89bbb7be04d9fbe38b47e2694c0bbe7
-
SHA512
80c5f4a047ad63c23ff5158f6966d066716c7ca826d5f9d55170b5a4508cbfb1bdcf153cb4c7e664408e5cbef85ca9ac6ba932f2a046060cce092a8316dff7dd
-
SSDEEP
12288:OCh9wJlnu3M5taezc6+RmstjlDa/ZSt4mv+ni5:FPwJlnu8ba2c6+RmsDa/ZSt4mv+ni5
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2068 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe -
Executes dropped EXE 1 IoCs
pid Process 2068 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 4948 3644 WerFault.exe 83 3444 2068 WerFault.exe 88 4380 2068 WerFault.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3644 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2068 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3644 wrote to memory of 2068 3644 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 88 PID 3644 wrote to memory of 2068 3644 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 88 PID 3644 wrote to memory of 2068 3644 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 3442⤵
- Program crash
PID:4948
-
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_eb4dc797b31871c193bd57e75feda4cd.exeC:\Users\Admin\AppData\Local\Temp\virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 3443⤵
- Program crash
PID:3444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 4003⤵
- Program crash
PID:4380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3644 -ip 36441⤵PID:184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2068 -ip 20681⤵PID:1208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2068 -ip 20681⤵PID:456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD54cb9048b2da1385ea8ba1646b325548e
SHA1c9746ec0ef56cbc2facab8bf68177941a47fb2ec
SHA25649222a7e90dced6e12579df88016f141f58f75e205a32474e49e03d18231efe7
SHA5125a4947fbff742ef36c1ce6a3d6c91a08e76ec8d4366d40e0ff56f1dd8e99bef9bdd6bcc316a6f8e3f07101765841dc2a82f5c95adb43be879723e60fe003ba29