Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    158s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2022, 17:56

General

  • Target

    09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89.exe

  • Size

    499KB

  • MD5

    6eeb0ca3294dacb042942f853aa42350

  • SHA1

    ca63122ed7be0dacd5532e52241261565f75d5f5

  • SHA256

    09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89

  • SHA512

    661b36a3768059e8103087d212e364704e04d27227536cf53939e96f2312e1c3456d0da5c3bf663cb05c00b12c88bf4a27823216e76969d97fded0bfb49a0e34

  • SSDEEP

    6144:CXXD6zNVVLp/AOAilRVIV2HYNO6s1ho/Gd2GXrVd+7HYNOK4BSdMNVjb7:CKNVZp/mYRiVdNdsjo/gBdfNQB+kv7

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89.exe
    "C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89mgr.exe
      C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89mgr.exe
      2⤵
      • Executes dropped EXE
      PID:4100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 260
        3⤵
        • Program crash
        PID:3528
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4100 -ip 4100
    1⤵
      PID:4016

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89mgr.exe

      Filesize

      104KB

      MD5

      1b8d3e127401ef0b666f129fa68a1a82

      SHA1

      47218021c6164911887138526185bd33c02d4bbd

      SHA256

      a00ecfd555960a71a4f06eafd801232f504481207736fcb7111a698cca95e8be

      SHA512

      acd37b10060cdd66e8191ab351126a57694df2f0ca821be942cafc78076f2d1c6809abe5a013db2e440ff4a5a749a3a7109be8485731b550e227699fd18385f8

    • C:\Users\Admin\AppData\Local\Temp\09ea496b544f99e493a8f70fbf3fac41bb5e1994fa5675331f0302f677015f89mgr.exe

      Filesize

      104KB

      MD5

      1b8d3e127401ef0b666f129fa68a1a82

      SHA1

      47218021c6164911887138526185bd33c02d4bbd

      SHA256

      a00ecfd555960a71a4f06eafd801232f504481207736fcb7111a698cca95e8be

      SHA512

      acd37b10060cdd66e8191ab351126a57694df2f0ca821be942cafc78076f2d1c6809abe5a013db2e440ff4a5a749a3a7109be8485731b550e227699fd18385f8

    • memory/1768-132-0x0000000000400000-0x000000000049F000-memory.dmp

      Filesize

      636KB

    • memory/1768-136-0x0000000000400000-0x000000000049F000-memory.dmp

      Filesize

      636KB

    • memory/4100-137-0x0000000000400000-0x000000000047D000-memory.dmp

      Filesize

      500KB