Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10virussign....50.exe
windows7-x64
7virussign....50.exe
windows10-2004-x64
7virussign....77.exe
windows7-x64
7virussign....77.exe
windows10-2004-x64
7virussign....f2.dll
windows7-x64
1virussign....f2.dll
windows10-2004-x64
1virussign....1f.exe
windows7-x64
10virussign....1f.exe
windows10-2004-x64
10virussign....cd.exe
windows7-x64
7virussign....cd.exe
windows10-2004-x64
7virussign....e8.exe
windows7-x64
5virussign....e8.exe
windows10-2004-x64
5virussign....b9.exe
windows7-x64
5virussign....b9.exe
windows10-2004-x64
5virussign....61.exe
windows7-x64
5virussign....61.exe
windows10-2004-x64
5virussign....94.exe
windows7-x64
5virussign....94.exe
windows10-2004-x64
5virussign....9f.exe
windows7-x64
10virussign....9f.exe
windows10-2004-x64
10virussign....b3.exe
windows7-x64
10virussign....b3.exe
windows10-2004-x64
10virussign....93.exe
windows7-x64
7virussign....93.exe
windows10-2004-x64
7virussign....8a.jar
windows7-x64
1virussign....8a.jar
windows10-2004-x64
1virussign....32.exe
windows7-x64
7virussign....32.exe
windows10-2004-x64
7virussign....02.exe
windows7-x64
5virussign....02.exe
windows10-2004-x64
5virussign....07.exe
windows7-x64
1virussign....07.exe
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 18:47
Behavioral task
behavioral1
Sample
virussign.com_e9db7f543abe55498e2fe9e81adbd150.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
virussign.com_e9db7f543abe55498e2fe9e81adbd150.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
virussign.com_eaaf615aa5e8154699b86613ef98de77.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
virussign.com_eaaf615aa5e8154699b86613ef98de77.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
virussign.com_eb1164afcd72b42faf1ed16fe69415f2.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
virussign.com_eb1164afcd72b42faf1ed16fe69415f2.dll
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
virussign.com_eb1a20a14bfd42ddd3c295062ff4c91f.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
virussign.com_eb1a20a14bfd42ddd3c295062ff4c91f.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral11
Sample
virussign.com_ec6cca2542808661cbc8b554736f52e8.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
virussign.com_ec6cca2542808661cbc8b554736f52e8.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
virussign.com_ecb767dd467a854cb9068795c708edb9.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
virussign.com_ecb767dd467a854cb9068795c708edb9.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral15
Sample
virussign.com_ecc04a1ce003b4a5edb12825179f3a61.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
virussign.com_ecc04a1ce003b4a5edb12825179f3a61.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral17
Sample
virussign.com_ed168bd396c4fdc03053f5b02fcf6994.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
virussign.com_ed168bd396c4fdc03053f5b02fcf6994.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral19
Sample
virussign.com_edbc11f0b4f0a9f3964923415573569f.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
virussign.com_edbc11f0b4f0a9f3964923415573569f.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral21
Sample
virussign.com_eec6bc403630659c6ed893e51572f6b3.exe
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
virussign.com_eec6bc403630659c6ed893e51572f6b3.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral23
Sample
virussign.com_eef74eda1855b3cf10300926cc0e0693.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
virussign.com_eef74eda1855b3cf10300926cc0e0693.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
virussign.com_f0b6e9f132c0d0549c401fe8943b708a.jar
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
virussign.com_f0b6e9f132c0d0549c401fe8943b708a.jar
Resource
win10v2004-20250129-en
Behavioral task
behavioral27
Sample
virussign.com_f0d49bace28a764cdbca55aafbd5da32.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
virussign.com_f0d49bace28a764cdbca55aafbd5da32.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral29
Sample
virussign.com_f201c60260bf5daf402404b095776202.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
virussign.com_f201c60260bf5daf402404b095776202.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral31
Sample
virussign.com_f34196caf20b1d0c9aca4ecca9fca907.exe
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
virussign.com_f34196caf20b1d0c9aca4ecca9fca907.exe
Resource
win10v2004-20250129-en
General
-
Target
virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe
-
Size
960KB
-
MD5
eb4dc797b31871c193bd57e75feda4cd
-
SHA1
6bbf67fdd8afb7169029c380759ed466bc6a9c6e
-
SHA256
6df068e0c186d1dcfbe22e568f0ae287f89bbb7be04d9fbe38b47e2694c0bbe7
-
SHA512
80c5f4a047ad63c23ff5158f6966d066716c7ca826d5f9d55170b5a4508cbfb1bdcf153cb4c7e664408e5cbef85ca9ac6ba932f2a046060cce092a8316dff7dd
-
SSDEEP
12288:OCh9wJlnu3M5taezc6+RmstjlDa/ZSt4mv+ni5:FPwJlnu8ba2c6+RmsDa/ZSt4mv+ni5
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3060 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe -
Executes dropped EXE 1 IoCs
pid Process 3060 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe -
Loads dropped DLL 4 IoCs
pid Process 2820 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2852 3060 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2820 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3060 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2820 wrote to memory of 3060 2820 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 31 PID 2820 wrote to memory of 3060 2820 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 31 PID 2820 wrote to memory of 3060 2820 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 31 PID 2820 wrote to memory of 3060 2820 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 31 PID 3060 wrote to memory of 2852 3060 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 32 PID 3060 wrote to memory of 2852 3060 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 32 PID 3060 wrote to memory of 2852 3060 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 32 PID 3060 wrote to memory of 2852 3060 virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\virussign.com_eb4dc797b31871c193bd57e75feda4cd.exeC:\Users\Admin\AppData\Local\Temp\virussign.com_eb4dc797b31871c193bd57e75feda4cd.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 1443⤵
- Loads dropped DLL
- Program crash
PID:2852
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD54dc25bf6cadcdcb982152c5dd189f9da
SHA1dfbf1e787a919e58918bcb5171044ef8c26115ba
SHA256cec7b333fc900b4d00a4934bc113d1481855eb5fb4b6a57d0ab451a5dc7a83ed
SHA5124fb7ed51d8af7826f1abeb125c6c4497cab0777d03677f2fd7ee4e814af08d4bd7340371d3d2eaf75affb12fedc5af51a9d72689f93d7f9fac197c08badfabcc