Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/02/2025, 03:50
Behavioral task
behavioral1
Sample
join.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
join.exe
-
Size
200KB
-
MD5
ea95542a4a96525ec8eaf1f26d6770c5
-
SHA1
c97a8c81d5105d8ab822edb1b68a1053e9fd2ded
-
SHA256
4e718d1c539bace6976465321f3c86e79c652fbdb34e1997888cac3b0e58c661
-
SHA512
09f0be9c78ef88029a67012a59d570dc29f8f6f3d7f57c07cc9778e6e4d320b943ae9d39882bbb58916129e984bc0b005eef46b77142c1931925d73c1568721c
-
SSDEEP
3072:PTqPRdyeIKDWx85IOlKeJVos/8eRwXiUUAdV95I4Rp+LH1xrl3Ez8ub8Xr:PTqPRddIKCC0ef//uXltKc+LVsz9b8
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3060 set thread context of 2700 3060 join.exe 30 -
resource yara_rule behavioral1/memory/2700-6-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2700-7-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2700-5-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2700-2-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2700-11-0x0000000000400000-0x0000000000453000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language join.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language join.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3060 join.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2700 3060 join.exe 30 PID 3060 wrote to memory of 2700 3060 join.exe 30 PID 3060 wrote to memory of 2700 3060 join.exe 30 PID 3060 wrote to memory of 2700 3060 join.exe 30 PID 3060 wrote to memory of 2700 3060 join.exe 30 PID 3060 wrote to memory of 2700 3060 join.exe 30 PID 3060 wrote to memory of 2700 3060 join.exe 30 PID 3060 wrote to memory of 2700 3060 join.exe 30 PID 3060 wrote to memory of 2700 3060 join.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\join.exe"C:\Users\Admin\AppData\Local\Temp\join.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\join.exe/scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"2⤵
- System Location Discovery: System Language Discovery
PID:2700
-