Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
99s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09/07/2020, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Documents.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Shipping Documents.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
Shipping Documents.exe
-
Size
590KB
-
MD5
e87f847dd6aea20684b67ab3eab8e992
-
SHA1
24531e53a0cffd0d4772bebebad7eb5a5071dfec
-
SHA256
e734cfb1c78da531edac0e5772b8892c4995862bffb6e8f5eb4bbc7a2090c174
-
SHA512
c222f478e1028cf7591f9f612dcb449e8b1e5278a608c665388a4338105afabab4d253f5738c4db678ed1a1770258083dd15560a135b2560e3860e242c05c057
Score
3/10
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2444 3988 WerFault.exe 65 -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe 2444 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2444 WerFault.exe Token: SeBackupPrivilege 2444 WerFault.exe Token: SeDebugPrivilege 2444 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"1⤵PID:3988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 9122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444
-