Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10out.exe
windows10-ltsc_2021-x64
3out.exe
windows7-x64
3out.exe
windows10-2004-x64
3out.exe
windows10-ltsc_2021-x64
3out.exe
windows11-21h2-x64
3out.exe
windows10-2004-x64
3out.exe
windows7-x64
3out.exe
windows10-2004-x64
3out.exe
windows10-ltsc_2021-x64
3out.exe
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
$PLUGINSDI...em.dll
windows7-x64
$PLUGINSDI...em.dll
windows10-2004-x64
$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
$PLUGINSDI...em.dll
windows11-21h2-x64
779389082
windows11-21h2-x64
779389082
windows7-x64
779389082
windows10-2004-x64
779389082
windows10-ltsc_2021-x64
779389082
windows11-21h2-x64
out.exe
windows11-21h2-x64
3out.exe
windows7-x64
3out.exe
windows10-2004-x64
3out.exe
windows10-ltsc_2021-x64
3out.exe
windows11-21h2-x64
3Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw 1025/03/2025, 15:06
250325-sg1d6a1px2 1025/03/2025, 15:01
250325-sd5jpsxyct 1025/03/2025, 14:56
250325-sbdcfaxxgs 1025/03/2025, 14:50
250325-r7ve6a1nv3 1025/03/2025, 14:46
250325-r5ab7sxwhx 1025/03/2025, 14:40
250325-r2c9paxwe1 1005/02/2025, 10:25
250205-mgcefaslhw 1005/02/2025, 10:17
250205-mbs51atmbk 1005/02/2025, 09:15
250205-k785zs1pfn 10Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/03/2025, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral2
Sample
out.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win11-20250313-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
out.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
out.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral9
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral10
Sample
out.exe
Resource
win11-20250314-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250313-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250314-en
Behavioral task
behavioral16
Sample
779389082
Resource
win11-20250314-en
Behavioral task
behavioral17
Sample
779389082
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
779389082
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
779389082
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral20
Sample
779389082
Resource
win11-20250314-en
Behavioral task
behavioral21
Sample
out.exe
Resource
win11-20250313-en
Behavioral task
behavioral22
Sample
out.exe
Resource
win7-20241010-en
Behavioral task
behavioral23
Sample
out.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral24
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral25
Sample
out.exe
Resource
win11-20250313-en
General
-
Target
out.exe
-
Size
376KB
-
MD5
79994194688c2a3f77e740450b05bb54
-
SHA1
98d4f00086ae1a5aa21d27f20bd2e9a0c6f7a0c3
-
SHA256
0e91b27341728082ebaa8765c96c769d2477b386d1c10c5757d0751a4ff39357
-
SHA512
f8a95c793ffb59388af66e30a1c2b9cf1a6e6f5740d64aed490458f3821d1d2ab5af1c89707c49317bd3851ff5ad4dafa8bdc1f714b0a4f04c5cf0a296216c78
-
SSDEEP
6144:6ONNYdX7HkqEHcyY6uoZzFyKAuGnlOOkl8tuGogbOIVB9J4:6ONNoX7HMHcyY6uoZzFyfONlwNBo
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 804 2548 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language out.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 804 2548 out.exe 30 PID 2548 wrote to memory of 804 2548 out.exe 30 PID 2548 wrote to memory of 804 2548 out.exe 30 PID 2548 wrote to memory of 804 2548 out.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\out.exeC:\Users\Admin\AppData\Local\Temp\out.exe bcdedit /set shutdown /r /f /t 21⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 362⤵
- Program crash
PID:804
-