Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1090ed1454b8...38.exe
windows7-x64
1090ed1454b8...38.exe
windows10-2004-x64
1091570920da...cf.exe
windows7-x64
1091570920da...cf.exe
windows10-2004-x64
7915c452bf2...b6.exe
windows7-x64
10915c452bf2...b6.exe
windows10-2004-x64
10916cd92d3a...38.exe
windows7-x64
10916cd92d3a...38.exe
windows10-2004-x64
10916fbe67a7...e3.exe
windows7-x64
10916fbe67a7...e3.exe
windows10-2004-x64
1091cce1a9f4...6a.exe
windows7-x64
1091cce1a9f4...6a.exe
windows10-2004-x64
1091d2e3f758...f6.exe
windows7-x64
1091d2e3f758...f6.exe
windows10-2004-x64
1091d7fa8d89...52.exe
windows7-x64
1091d7fa8d89...52.exe
windows10-2004-x64
1091e6d47bd8...cc.exe
windows7-x64
791e6d47bd8...cc.exe
windows10-2004-x64
792105c7a3b...24.exe
windows7-x64
792105c7a3b...24.exe
windows10-2004-x64
7921421b7f5...09.exe
windows7-x64
10921421b7f5...09.exe
windows10-2004-x64
109221b9eea3...3c.exe
windows7-x64
19221b9eea3...3c.exe
windows10-2004-x64
1092324d5776...05.exe
windows7-x64
192324d5776...05.exe
windows10-2004-x64
1927cd0bd1a...b8.exe
windows7-x64
3927cd0bd1a...b8.exe
windows10-2004-x64
392efd55895...78.exe
windows7-x64
1092efd55895...78.exe
windows10-2004-x64
10932a9096cd...eb.exe
windows7-x64
10932a9096cd...eb.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:14
Behavioral task
behavioral1
Sample
90ed1454b881cba4ecd9b651325d4638.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
90ed1454b881cba4ecd9b651325d4638.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
915c452bf258459048ef8813fe2586a7b3c85ae7438fcd9bfa6da3a4017a08b6.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
915c452bf258459048ef8813fe2586a7b3c85ae7438fcd9bfa6da3a4017a08b6.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
916cd92d3ac28dded1335ac06764e138.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
916cd92d3ac28dded1335ac06764e138.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
916fbe67a7968d2b65d54ae3ce72f3e3.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
916fbe67a7968d2b65d54ae3ce72f3e3.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
91cce1a9f4562b0cd73d60203cebb76a.exe
Resource
win7-20241023-en
Behavioral task
behavioral12
Sample
91cce1a9f4562b0cd73d60203cebb76a.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
91d2e3f758fbb2c6c8e7b069bd3ac7a4d68e4f9dea0e71ff60bdbcd2ac9dd4f6.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
91d2e3f758fbb2c6c8e7b069bd3ac7a4d68e4f9dea0e71ff60bdbcd2ac9dd4f6.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
91d7fa8d891f603b35c77da7fcc4c552.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
91d7fa8d891f603b35c77da7fcc4c552.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
91e6d47bd804e58a4e160993dfdfc3cc.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
91e6d47bd804e58a4e160993dfdfc3cc.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
92105c7a3b72655063939b49b38e6567d6703ed95f694cab2247bd9832706524.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
92105c7a3b72655063939b49b38e6567d6703ed95f694cab2247bd9832706524.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
921421b7f5be88eb661517835c090cd8a2fdcdfc69154d129c70ffa36da54809.exe
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
921421b7f5be88eb661517835c090cd8a2fdcdfc69154d129c70ffa36da54809.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
9221b9eea367a2434dacd850f7b30b3c.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
9221b9eea367a2434dacd850f7b30b3c.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
92324d5776518f262a2ce8bfd8c6856500a9c454b9a8b688810f604111532e05.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
92324d5776518f262a2ce8bfd8c6856500a9c454b9a8b688810f604111532e05.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
927cd0bd1a26a2158a18e48e682ba3b8.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
927cd0bd1a26a2158a18e48e682ba3b8.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
92efd55895cd60b5057f3fb06ad84c78.exe
Resource
win7-20250207-en
Behavioral task
behavioral30
Sample
92efd55895cd60b5057f3fb06ad84c78.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
932a9096cd16630970f2bdc5e6cb9aeb.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
932a9096cd16630970f2bdc5e6cb9aeb.exe
Resource
win10v2004-20250314-en
General
-
Target
91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe
-
Size
579KB
-
MD5
38f3e0dd8421dbfd12de577c02ae99f3
-
SHA1
5b35e3629e60e952e9ec4910a9ced8bf24d3f06e
-
SHA256
91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf
-
SHA512
efc2829b526f19600a3153297ef204b2820ba3117391a8b33760f39e180c5782b94c6b2dfbb16a9ca0416cb9b91302176f0f0c6f5f184be9584308f62c54dfd8
-
SSDEEP
12288:YbD5arFJwK6hMJ6ZzHFZfc28beMGTfZuqb7M:rBJwdhMJ6ZzHrfcsMGTfZ5PM
Malware Config
Signatures
-
Imminent family
-
Executes dropped EXE 1 IoCs
pid Process 2816 Webfrequency.exe -
Loads dropped DLL 1 IoCs
pid Process 1600 91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webdevelop = "C:\\Users\\Admin\\AppData\\Roaming\\Webdevelop\\Webfrequency.exe" 91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2816 set thread context of 876 2816 Webfrequency.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Webfrequency.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 876 RegAsm.exe Token: 33 876 RegAsm.exe Token: SeIncBasePriorityPrivilege 876 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 876 RegAsm.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2816 1600 91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe 30 PID 1600 wrote to memory of 2816 1600 91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe 30 PID 1600 wrote to memory of 2816 1600 91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe 30 PID 1600 wrote to memory of 2816 1600 91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe 30 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32 PID 2816 wrote to memory of 876 2816 Webfrequency.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe"C:\Users\Admin\AppData\Local\Temp\91570920daa6ee3c5d03da7664cb620ac5be5038ac64a295811ed8349b5d3dcf.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"C:\Users\Admin\AppData\Roaming\Webdevelop\Webfrequency.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:876
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
579KB
MD5116eb5c1d59329314c32999bcf5e5ac5
SHA1b38bea35bd6a1d676a042227baf2f97d0ca68921
SHA25646ae8214ea735c3504e305b838d829782ff79d035c1ff6a00e95e676e6b30cda
SHA512bbfbe683eb44dd92b9ff6b6210f70d250459956030f0a878dcfe5b955029cd14038a8d536aff911064245889dd33d931ae474b9f80295a0a7f0c202fbd74659e