Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10virussign....50.exe
windows7-x64
7virussign....50.exe
windows10-2004-x64
7virussign....77.exe
windows7-x64
7virussign....77.exe
windows10-2004-x64
7virussign....f2.dll
windows7-x64
1virussign....f2.dll
windows10-2004-x64
1virussign....1f.exe
windows7-x64
10virussign....1f.exe
windows10-2004-x64
10virussign....cd.exe
windows7-x64
7virussign....cd.exe
windows10-2004-x64
7virussign....e8.exe
windows7-x64
5virussign....e8.exe
windows10-2004-x64
5virussign....b9.exe
windows7-x64
5virussign....b9.exe
windows10-2004-x64
5virussign....61.exe
windows7-x64
5virussign....61.exe
windows10-2004-x64
5virussign....94.exe
windows7-x64
5virussign....94.exe
windows10-2004-x64
5virussign....9f.exe
windows7-x64
10virussign....9f.exe
windows10-2004-x64
10virussign....b3.exe
windows7-x64
10virussign....b3.exe
windows10-2004-x64
10virussign....93.exe
windows7-x64
7virussign....93.exe
windows10-2004-x64
7virussign....8a.jar
windows7-x64
1virussign....8a.jar
windows10-2004-x64
1virussign....32.exe
windows7-x64
7virussign....32.exe
windows10-2004-x64
7virussign....02.exe
windows7-x64
5virussign....02.exe
windows10-2004-x64
5virussign....07.exe
windows7-x64
1virussign....07.exe
windows10-2004-x64
3Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
31/01/2025, 18:47
Behavioral task
behavioral1
Sample
virussign.com_e9db7f543abe55498e2fe9e81adbd150.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
virussign.com_e9db7f543abe55498e2fe9e81adbd150.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
virussign.com_eaaf615aa5e8154699b86613ef98de77.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
virussign.com_eaaf615aa5e8154699b86613ef98de77.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
virussign.com_eb1164afcd72b42faf1ed16fe69415f2.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
virussign.com_eb1164afcd72b42faf1ed16fe69415f2.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
virussign.com_eb1a20a14bfd42ddd3c295062ff4c91f.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
virussign.com_eb1a20a14bfd42ddd3c295062ff4c91f.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
virussign.com_ec6cca2542808661cbc8b554736f52e8.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
virussign.com_ec6cca2542808661cbc8b554736f52e8.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
virussign.com_ecb767dd467a854cb9068795c708edb9.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
virussign.com_ecb767dd467a854cb9068795c708edb9.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral15
Sample
virussign.com_ecc04a1ce003b4a5edb12825179f3a61.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
virussign.com_ecc04a1ce003b4a5edb12825179f3a61.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral17
Sample
virussign.com_ed168bd396c4fdc03053f5b02fcf6994.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
virussign.com_ed168bd396c4fdc03053f5b02fcf6994.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral19
Sample
virussign.com_edbc11f0b4f0a9f3964923415573569f.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
virussign.com_edbc11f0b4f0a9f3964923415573569f.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral21
Sample
virussign.com_eec6bc403630659c6ed893e51572f6b3.exe
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
virussign.com_eec6bc403630659c6ed893e51572f6b3.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral23
Sample
virussign.com_eef74eda1855b3cf10300926cc0e0693.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
virussign.com_eef74eda1855b3cf10300926cc0e0693.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
virussign.com_f0b6e9f132c0d0549c401fe8943b708a.jar
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
virussign.com_f0b6e9f132c0d0549c401fe8943b708a.jar
Resource
win10v2004-20250129-en
Behavioral task
behavioral27
Sample
virussign.com_f0d49bace28a764cdbca55aafbd5da32.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
virussign.com_f0d49bace28a764cdbca55aafbd5da32.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral29
Sample
virussign.com_f201c60260bf5daf402404b095776202.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
virussign.com_f201c60260bf5daf402404b095776202.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral31
Sample
virussign.com_f34196caf20b1d0c9aca4ecca9fca907.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
virussign.com_f34196caf20b1d0c9aca4ecca9fca907.exe
Resource
win10v2004-20250129-en
General
-
Target
virussign.com_ed168bd396c4fdc03053f5b02fcf6994.exe
-
Size
83KB
-
MD5
ed168bd396c4fdc03053f5b02fcf6994
-
SHA1
fa83602f13cc058945dc0ffe796510bd73432ef6
-
SHA256
7c1118da7a1ad2ca1409b0b99a7fafacf27dd4174dc74601cd23273b056f5d95
-
SHA512
0fc3956fd25723db4d3f4b87a202393aa15a8ad27e03ce0ea96a7ed9c8a21ba1e5150411ae18dc1ee80aa249de3b35bb0c5acd58f5a24b5856fa8e82f677ec98
-
SSDEEP
1536:LJaPJpAz869DUxWB+i4OQ4NR2Kk+aSnfZaG8fcaOCzGquSE0cF+EK+:LJ0TAz6Mte4A+aaZx8EnCGVuEH
Malware Config
Signatures
-
resource yara_rule behavioral18/memory/916-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral18/memory/916-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral18/memory/916-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral18/files/0x000c000000023b27-12.dat upx behavioral18/memory/916-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral18/memory/916-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral18/memory/916-29-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_ed168bd396c4fdc03053f5b02fcf6994.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5a1a1151bc0e63b23db2a62b6cde8071f
SHA1f9f60d02074b3cf36fc6d58e8ae21391d801926c
SHA256fd794ce16a2c79eb4f285bbe6d3b8df2123e73fd80d29662ef9a7373430c1678
SHA51281a7f7877c96b9bf2d3ba667e407e0be3c7aec8fd033b6d9492973c0e8507c7749d8701fa8d1c9e168668e34d051f6a9cd56d779bb40ca96a8330a7281b4f9c0