Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/02/2025, 11:07
Static task
static1
Behavioral task
behavioral1
Sample
3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe
Resource
win7-20240903-en
General
-
Target
3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe
-
Size
64KB
-
MD5
4552c7d2fcbc04b14cd616b422486c8b
-
SHA1
b615d31bf56fa0576f422149f3df47019b39a70d
-
SHA256
3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc
-
SHA512
ca51b7dacd425da7723122f277aceb7435ace874ebceef4159608ce934ad5d6a19b82b7b259486e6e1068a4a3c4f54d9140b533d3a3a5fa6295de36967e1efe2
-
SSDEEP
1536:3EFRfIIajeMzBdiGN9BbwNLi2bhtbxnCAumXG:4RfIIYnbONVv5CAFXG
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2464 set thread context of 2056 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2056 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe 31 PID 2464 wrote to memory of 2056 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe 31 PID 2464 wrote to memory of 2056 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe 31 PID 2464 wrote to memory of 2056 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe 31 PID 2464 wrote to memory of 2056 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe 31 PID 2464 wrote to memory of 2056 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe 31 PID 2464 wrote to memory of 2056 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe 31 PID 2464 wrote to memory of 2056 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe 31 PID 2464 wrote to memory of 2056 2464 3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe"C:\Users\Admin\AppData\Local\Temp\3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exeC:\Users\Admin\AppData\Local\Temp\3fff7ae85bdb3e3f58ba32a41e1b9e81c142c4a88288020b9356e9fb78d4cafc.exe2⤵PID:2056
-