Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 08:04
Behavioral task
behavioral1
Sample
bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe
Resource
win10v2004-20220901-en
General
-
Target
bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe
-
Size
210KB
-
MD5
dc842b6ebb3d7184ee5a6dc01556592d
-
SHA1
0ca0f5ce85b0fc3260a738d702f8a3d79a9f9373
-
SHA256
bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7
-
SHA512
345b868398ed71ea9c6910bbe7caa7755a9828fd54ffb6978d9b3da12a66615bcc0096a919645baa239d2183e92b365e7ff606cf8361ee00fa8d752ccffab892
-
SSDEEP
3072:WRjfB5z2Z8kOXEtPO30B/0HW2JNV+/2Bht/DDMwLPWYIv+3Du3IoIbDgVyOIioTe:ujjXCOEp0FLjtbwyWYImq3ZqD3Yib
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4532-132-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe File opened for modification C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4296 4532 WerFault.exe 83 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4532 bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4532 bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe 4532 bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe"C:\Users\Admin\AppData\Local\Temp\bcf8f37ca47847522112e4e5ae69ef21f1a55916c5999db7751349bb6cc04cf7.exe"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 13082⤵
- Program crash
PID:4296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4532 -ip 45321⤵PID:4636