Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 10:57

General

  • Target

    b0e23b57b00d2d60845c57c8b712b06fc2b04c4c772ed12ae6ff4da55f6edaf8.exe

  • Size

    856KB

  • MD5

    70468606a8a9d89f3a072356b9a36ff0

  • SHA1

    498c188f02cb551c76aae3b0a9d8854e2d228cbb

  • SHA256

    b0e23b57b00d2d60845c57c8b712b06fc2b04c4c772ed12ae6ff4da55f6edaf8

  • SHA512

    edec75128fa8359e365f851833dfbecb2797157569e2a1b2a00667d658888e278fd9683e1d0a5a5ecde690502ff74c577f0ab9154e0f48c3ff5eaa64452b4550

  • SSDEEP

    12288:dNOVvQ08oa2FzG7ABq7bu24yyAZq45GtWobcVnSGtF+ZwKgxvNofc581kScMP00h:nOVAqFq7x7bu2XhYcoAnSQdvNqkS40

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0e23b57b00d2d60845c57c8b712b06fc2b04c4c772ed12ae6ff4da55f6edaf8.exe
    "C:\Users\Admin\AppData\Local\Temp\b0e23b57b00d2d60845c57c8b712b06fc2b04c4c772ed12ae6ff4da55f6edaf8.exe"
    1⤵
    • Adds Run key to start application
    PID:2112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 832
      2⤵
      • Program crash
      PID:3600
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2112 -ip 2112
    1⤵
      PID:2064

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2112-132-0x0000000001000000-0x0000000001439FF4-memory.dmp

      Filesize

      4.2MB

    • memory/2112-133-0x0000000000671000-0x00000000006DA000-memory.dmp

      Filesize

      420KB

    • memory/2112-134-0x0000000001000000-0x0000000001439FF4-memory.dmp

      Filesize

      4.2MB

    • memory/2112-135-0x0000000000671000-0x00000000006DA000-memory.dmp

      Filesize

      420KB