Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 08:38

General

  • Target

    91c844b8ad32c9119d75e7459579d0d90137d560ee496dc2664caf6e85aba524.exe

  • Size

    58KB

  • MD5

    4b74cb34f9927a838389d98f0a9902f2

  • SHA1

    612170ebe4292784434022016892745fa1b472bd

  • SHA256

    91c844b8ad32c9119d75e7459579d0d90137d560ee496dc2664caf6e85aba524

  • SHA512

    8d62c2f0f602c74a526299034c78bf9e03292aff0693bd099f7d09aa738f144ac71c7436c159c66ba482aa29790a297350db33d8104dc01bdda6ff152f9c69b1

  • SSDEEP

    768:qFeskANtWy6U13GXcda9ZQLkr8fRjj42c6TmtAtaK6B7Ix2uAfLiox613zJT1Bmx:qdj0+WOsskrH2NtaK6RiAfLi9JfF81

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91c844b8ad32c9119d75e7459579d0d90137d560ee496dc2664caf6e85aba524.exe
    "C:\Users\Admin\AppData\Local\Temp\91c844b8ad32c9119d75e7459579d0d90137d560ee496dc2664caf6e85aba524.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Users\Admin\AppData\Local\Temp\91c844b8ad32c9119d75e7459579d0d90137d560ee496dc2664caf6e85aba524.exe
      2⤵
      • Writes to the Master Boot Record (MBR)
      PID:1808
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 312
        3⤵
        • Program crash
        PID:2588
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1808 -ip 1808
    1⤵
      PID:2548

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1808-135-0x000000002AA00000-0x000000002AA04000-memory.dmp

      Filesize

      16KB

    • memory/1808-137-0x000000002AA00000-0x000000002AA04000-memory.dmp

      Filesize

      16KB

    • memory/1808-138-0x000000002AA00000-0x000000002AA04000-memory.dmp

      Filesize

      16KB