Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10out.exe
windows10-ltsc_2021-x64
3out.exe
windows7-x64
3out.exe
windows10-2004-x64
3out.exe
windows10-ltsc_2021-x64
3out.exe
windows11-21h2-x64
3out.exe
windows10-2004-x64
3out.exe
windows7-x64
3out.exe
windows10-2004-x64
3out.exe
windows10-ltsc_2021-x64
3out.exe
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
$PLUGINSDI...em.dll
windows7-x64
$PLUGINSDI...em.dll
windows10-2004-x64
$PLUGINSDI...em.dll
windows10-ltsc_2021-x64
$PLUGINSDI...em.dll
windows11-21h2-x64
779389082
windows11-21h2-x64
779389082
windows7-x64
779389082
windows10-2004-x64
779389082
windows10-ltsc_2021-x64
779389082
windows11-21h2-x64
out.exe
windows11-21h2-x64
3out.exe
windows7-x64
3out.exe
windows10-2004-x64
3out.exe
windows10-ltsc_2021-x64
3out.exe
windows11-21h2-x64
3Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw 1025/03/2025, 15:06
250325-sg1d6a1px2 1025/03/2025, 15:01
250325-sd5jpsxyct 1025/03/2025, 14:56
250325-sbdcfaxxgs 1025/03/2025, 14:50
250325-r7ve6a1nv3 1025/03/2025, 14:46
250325-r5ab7sxwhx 1025/03/2025, 14:40
250325-r2c9paxwe1 1005/02/2025, 10:25
250205-mgcefaslhw 1005/02/2025, 10:17
250205-mbs51atmbk 1005/02/2025, 09:15
250205-k785zs1pfn 10Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
25/03/2025, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral2
Sample
out.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win11-20250313-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
out.exe
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
out.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral9
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral10
Sample
out.exe
Resource
win11-20250314-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250313-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250314-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250314-en
Behavioral task
behavioral16
Sample
779389082
Resource
win11-20250314-en
Behavioral task
behavioral17
Sample
779389082
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
779389082
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
779389082
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral20
Sample
779389082
Resource
win11-20250314-en
Behavioral task
behavioral21
Sample
out.exe
Resource
win11-20250313-en
Behavioral task
behavioral22
Sample
out.exe
Resource
win7-20241010-en
Behavioral task
behavioral23
Sample
out.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral24
Sample
out.exe
Resource
win10ltsc2021-20250314-en
Behavioral task
behavioral25
Sample
out.exe
Resource
win11-20250313-en
General
-
Target
out.exe
-
Size
40KB
-
MD5
1dc19cb4abfbdfce5b34756603fb5d43
-
SHA1
8b2d7f82fc13888bf0fa97c1fe73ae8eb615b703
-
SHA256
c1bac7436253ca3e66f36dfdbc1f237cf4c6bc0cf7f2dec5dd9ed9611d16191f
-
SHA512
394dc2752498ebea6ae44172e337f764034fd78187b79d5a8c1c525811802c04b20edb9a885aecc4f6e417e250ca42b08993774fee40986e1eb3209a05ce8e5d
-
SSDEEP
384:moyzEpcGhIxJl9JEdauBNa/nu333s8JrxRMt0GNtslmlLpB1pyLloyGw6Bm7lpIn:mo4EpThIpEdauX3hS/sjfkGudUj9Vg
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2080 1484 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language out.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1484 wrote to memory of 2080 1484 out.exe 31 PID 1484 wrote to memory of 2080 1484 out.exe 31 PID 1484 wrote to memory of 2080 1484 out.exe 31 PID 1484 wrote to memory of 2080 1484 out.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\out.exeC:\Users\Admin\AppData\Local\Temp\out.exe bcdedit /set shutdown /r /f /t 21⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 362⤵
- Program crash
PID:2080
-