Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
11/03/2025, 04:53
Static task
static1
Behavioral task
behavioral1
Sample
c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe
Resource
win7-20250207-en
General
-
Target
c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe
-
Size
311KB
-
MD5
9d987a16f2c44ba82fae968214b863be
-
SHA1
961c8eeab295364d45ff3ad68c4ad77f592c8226
-
SHA256
c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d
-
SHA512
709830c8c732997e08c0e0b81322ef95bc3a25825ec1d9e86af2d9ac6b289bcdbd5d3e446277dd8049625ca694404e4eac95e37fcbd0a5c4ee8c548edad83807
-
SSDEEP
6144:cN8gWgVacaPSVWhDvVbx18IcUSxlI9Tj+5REQZ87wq6tecuoLi9MNj:IWgUblv82SxQUm7X6tecuIi9MNj
Malware Config
Extracted
darkcloud
https://api.telegram.org/bot6107929879:AAHV6JwXs7rcYzMGLe3_opR5_gdKAC16Ye4/sendMessage?chat_id=6311012313
Signatures
-
Darkcloud family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2996 set thread context of 2264 2996 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language caspol.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2264 caspol.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2264 2996 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 28 PID 2996 wrote to memory of 2264 2996 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 28 PID 2996 wrote to memory of 2264 2996 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 28 PID 2996 wrote to memory of 2264 2996 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 28 PID 2996 wrote to memory of 2264 2996 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 28 PID 2996 wrote to memory of 2264 2996 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 28 PID 2996 wrote to memory of 2264 2996 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 28 PID 2996 wrote to memory of 2264 2996 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 28 PID 2996 wrote to memory of 2264 2996 c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe"C:\Users\Admin\AppData\Local\Temp\c979cdb1c5a3987d61e1e90e14e969a3d9dad1aa554c5e2d66b3ac36b2e0953d.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\caspol.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2264
-