Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/03/2025, 03:02
Static task
static1
Behavioral task
behavioral1
Sample
47bc1b10e6eb7a8b90d5549c5b590599255d77375de41ed88a2f780487d14ddc.exe
Resource
win7-20240903-en
General
-
Target
47bc1b10e6eb7a8b90d5549c5b590599255d77375de41ed88a2f780487d14ddc.exe
-
Size
11KB
-
MD5
4343afd540ca9cb0d7faf256b45c60cc
-
SHA1
9f04ddad422db811503ed15029e480005c84c810
-
SHA256
47bc1b10e6eb7a8b90d5549c5b590599255d77375de41ed88a2f780487d14ddc
-
SHA512
1301c8e0287a2135f26937ca894978414caeeb78e8b0fba581fffb07cecd2bc1475b89b8086a658af098e9d4aca8c1e14632ac9ef46187fc768c3f42693acca8
-
SSDEEP
192:iYJoCeCH4f5PZ5g3B8Z9/ktvhjwVF4/UTabVPot:iY2TCYRB5gR8nktla+M+1
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47bc1b10e6eb7a8b90d5549c5b590599255d77375de41ed88a2f780487d14ddc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2276 47bc1b10e6eb7a8b90d5549c5b590599255d77375de41ed88a2f780487d14ddc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47bc1b10e6eb7a8b90d5549c5b590599255d77375de41ed88a2f780487d14ddc.exe"C:\Users\Admin\AppData\Local\Temp\47bc1b10e6eb7a8b90d5549c5b590599255d77375de41ed88a2f780487d14ddc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2276