Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/02/2025, 15:27
Static task
static1
Behavioral task
behavioral1
Sample
Momskoden.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Momskoden.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250207-en
General
-
Target
Momskoden.exe
-
Size
1.1MB
-
MD5
2aa166a2719616ff7ac82aae31277dc5
-
SHA1
dc700c6982137fb9f3cdd79b95a8539ebcc6841c
-
SHA256
95292a0804f091e9b5f726378631f330ba1fa117d5465ded18baf8153cbdff8a
-
SHA512
0bdb971d1f5c9e33c9800d14050a4933b613c42257129417d56aaf78bdf972b72619baccf84682a95f77cb11dd17cd4755c431a0b8fa60db64bff3cccbeec47c
-
SSDEEP
24576:cV8omiiDPDeynqve96wbfqiPACOedfHYNXNHA6a:cV8PPDPqve93/ACOdHAp
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1256 Momskoden.exe 1256 Momskoden.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Peppercorns241\septobasidium.ini Momskoden.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1712 1256 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Momskoden.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1256 wrote to memory of 1712 1256 Momskoden.exe 31 PID 1256 wrote to memory of 1712 1256 Momskoden.exe 31 PID 1256 wrote to memory of 1712 1256 Momskoden.exe 31 PID 1256 wrote to memory of 1712 1256 Momskoden.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Momskoden.exe"C:\Users\Admin\AppData\Local\Temp\Momskoden.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 4802⤵
- Program crash
PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD534442e1e0c2870341df55e1b7b3cccdc
SHA199b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA256269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
SHA5124a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51