Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/10/2022, 11:14

221016-nchakahdan 6

16/10/2022, 10:56

221016-m149kahda3 3

Analysis

  • max time kernel
    49s
  • max time network
    268s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/10/2022, 10:56

General

  • Target

    9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe

  • Size

    3.9MB

  • MD5

    d8dfac398555e946ecc533198738f8c6

  • SHA1

    35f4571b7efe542d6a5b7681d8d9276274c0d52d

  • SHA256

    9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675

  • SHA512

    5df2fd14453cd47f3db78ba48b9771253033e05807feead7c7174738f5d5ea6b18a47f68d55f88fb9d9d2dbac25f3af2d2bbad9f3087ef1b330d2c43c35b4939

  • SSDEEP

    98304:a9KhGI6eXdNk/kgz/3lvoYXHbpEYpJDW5sRhjQFfy:aqD6eXPBQ/3lwYXlEYphWmRqy

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe
    "C:\Users\Admin\AppData\Local\Temp\9beb3fcad21f5ff7378d14217abeaa734cb1272471ca928185186e7a52678675.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2732
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2732 -s 1896
      2⤵
      • Program crash
      PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2732-120-0x000001823E300000-0x000001823E6F2000-memory.dmp

    Filesize

    3.9MB

  • memory/2732-121-0x0000018258BF0000-0x0000018258F58000-memory.dmp

    Filesize

    3.4MB

  • memory/2732-122-0x000001825BEA0000-0x000001825C1FC000-memory.dmp

    Filesize

    3.4MB

  • memory/2732-123-0x000001825C200000-0x000001825C48E000-memory.dmp

    Filesize

    2.6MB

  • memory/2732-124-0x000001825C4B0000-0x000001825C4C2000-memory.dmp

    Filesize

    72KB

  • memory/2732-125-0x000001825C9B0000-0x000001825CE7A000-memory.dmp

    Filesize

    4.8MB

  • memory/2732-126-0x00007FFCD17B0000-0x00007FFCD198B000-memory.dmp

    Filesize

    1.9MB

  • memory/2732-127-0x00007FFCD17B0000-0x00007FFCD198B000-memory.dmp

    Filesize

    1.9MB