Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/02/2025, 18:18
Behavioral task
behavioral1
Sample
whiteshadow123.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
whiteshadow123.exe
Resource
win10ltsc2021-20250207-en
Behavioral task
behavioral3
Sample
whiteshadow123.exe
Resource
win11-20250207-en
General
-
Target
whiteshadow123.exe
-
Size
7.6MB
-
MD5
53d48938c0ec850eb316cf433ecfc045
-
SHA1
4415a85e1376c1a8f6661a2cc9d23ec06557d176
-
SHA256
f63f7d8db3ae8ed7448672263cf9333e8b867bdba7a30d73cf3966cfd8a8a909
-
SHA512
21a69b5969f95e4dfd404e6c415ec502282f4e54aa73c0752a29af52bdbf603837ddab640bca47c317f391f91a5f60818d5f06662c600f5e01e43e2473408c99
-
SSDEEP
49152:fzHJcgg9WcnmdpY+RQCcUVTTyXcrlogXIu9zt8e1fW8hu4ARsmK2bOAPyz8bWP8y:fzSmcnJ+GKtGcRosIUz1SrKkyz8w
Malware Config
Extracted
cryptbot
http://home.twelve12vs.top/AvWHJxAVCxPehbRictmJ10
Signatures
-
Cryptbot family
-
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF whiteshadow123.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2656 1976 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language whiteshadow123.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1976 whiteshadow123.exe 1976 whiteshadow123.exe 1976 whiteshadow123.exe 1976 whiteshadow123.exe 1976 whiteshadow123.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2656 1976 whiteshadow123.exe 31 PID 1976 wrote to memory of 2656 1976 whiteshadow123.exe 31 PID 1976 wrote to memory of 2656 1976 whiteshadow123.exe 31 PID 1976 wrote to memory of 2656 1976 whiteshadow123.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\whiteshadow123.exe"C:\Users\Admin\AppData\Local\Temp\whiteshadow123.exe"1⤵
- Enumerates VirtualBox registry keys
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 4722⤵
- Program crash
PID:2656
-