Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10out.exe
windows10-ltsc_2021-x64
3out.exe
windows7-x64
3out.exe
windows10-2004-x64
3out.exe
windows10-ltsc_2021-x64
3out.exe
windows11-21h2-x64
3out.exe
windows10-2004-x64
3out.exe
windows7-x64
3out.exe
windows10-2004-x64
3out.exe
windows10-ltsc_2021-x64
3out.exe
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
$PLUGINSDI...em.dll
windows7-x64
$PLUGINSDI...em.dll
windows10-2004-x64
$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
$PLUGINSDI...em.dll
windows11-21h2-x64
779389082
windows11-21h2-x64
779389082
windows7-x64
779389082
windows10-2004-x64
779389082
windows10-ltsc_2021-x64
779389082
windows11-21h2-x64
out.exe
windows11-21h2-x64
3out.exe
windows7-x64
3out.exe
windows10-2004-x64
3out.exe
windows10-ltsc_2021-x64
3out.exe
windows11-21h2-x64
3Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw 1025/03/2025, 15:06
250325-sg1d6a1px2 1025/03/2025, 15:01
250325-sd5jpsxyct 1025/03/2025, 14:56
250325-sbdcfaxxgs 1025/03/2025, 14:50
250325-r7ve6a1nv3 1025/03/2025, 14:46
250325-r5ab7sxwhx 1025/03/2025, 14:40
250325-r2c9paxwe1 1005/02/2025, 10:25
250205-mgcefaslhw 1005/02/2025, 10:17
250205-mbs51atmbk 1005/02/2025, 09:15
250205-k785zs1pfn 10Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/03/2025, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral2
Sample
out.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win11-20250313-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
out.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
out.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral9
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral10
Sample
out.exe
Resource
win11-20250314-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250313-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250314-en
Behavioral task
behavioral16
Sample
779389082
Resource
win11-20250314-en
Behavioral task
behavioral17
Sample
779389082
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
779389082
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
779389082
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral20
Sample
779389082
Resource
win11-20250314-en
Behavioral task
behavioral21
Sample
out.exe
Resource
win11-20250313-en
Behavioral task
behavioral22
Sample
out.exe
Resource
win7-20241010-en
Behavioral task
behavioral23
Sample
out.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral24
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral25
Sample
out.exe
Resource
win11-20250313-en
General
-
Target
out.exe
-
Size
59KB
-
MD5
e685142e6a7aa02d184bd33ea1e38365
-
SHA1
e6d8ff6eb9f040346de1d085b7138513baff4406
-
SHA256
adfd80323fa60aab36f3217f37580b462168bc414e65deebd5b2609d22b826a2
-
SHA512
55d0790f1c4fffb28f68a33f016fab2e6092602c746e8c918d91f98005f3c473ced73a30841e3a951c47f8c7de73f3050c8af16146665e9d8ec955830320aec6
-
SSDEEP
768:DTjagICPhDt3bS4nyzRCuwSbV5dNcxGV1ylQ+Ix:RpDtG4nMEboDTV1ylnI
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2972 1640 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language out.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1640 wrote to memory of 2972 1640 out.exe 30 PID 1640 wrote to memory of 2972 1640 out.exe 30 PID 1640 wrote to memory of 2972 1640 out.exe 30 PID 1640 wrote to memory of 2972 1640 out.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\out.exeC:\Users\Admin\AppData\Local\Temp\out.exe bcdedit /set shutdown /r /f /t 21⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 362⤵
- Program crash
PID:2972
-