Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 08:43
Static task
static1
Behavioral task
behavioral1
Sample
61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe
Resource
win10v2004-20220812-en
General
-
Target
61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe
-
Size
641KB
-
MD5
20d469ae06ffceb327eecd5a03855cf0
-
SHA1
5e025a1461d7bde5b5901270135865cb8b5f6809
-
SHA256
61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede
-
SHA512
d623ef1298e6b4233fc7b76b165eb50f0579bde268bcfa0d29e4d06652c503ba23ca27e3924a21adb423fc0e8b74433fffc941f9a4a1cde22a1b99b9c4ae38e2
-
SSDEEP
12288:AFkDklOJ1ZNs+0FNP0K/Ejpv4sNB07UzhFdIL2IG7DzgX8FYg6V:P4lOJbi+0/0K/Ex4qB07UzndK2pYXngm
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 1388 5040 WerFault.exe 82 2160 1488 WerFault.exe 85 3668 1400 WerFault.exe 86 -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\ 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5040 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe 5040 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe -
Suspicious use of UnmapMainImage 3 IoCs
pid Process 5040 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe 1488 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe 1400 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5040 wrote to memory of 1488 5040 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe 85 PID 5040 wrote to memory of 1488 5040 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe 85 PID 5040 wrote to memory of 1488 5040 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe 85 PID 5040 wrote to memory of 1400 5040 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe 86 PID 5040 wrote to memory of 1400 5040 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe 86 PID 5040 wrote to memory of 1400 5040 61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe"C:\Users\Admin\AppData\Local\Temp\61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 5002⤵
- Program crash
PID:1388
-
-
C:\Users\Admin\AppData\Local\Temp\61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exestart2⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious use of UnmapMainImage
PID:1488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 4963⤵
- Program crash
PID:2160
-
-
-
C:\Users\Admin\AppData\Local\Temp\61bbf75f939c87c6cd57fe4fa8ff3baf5b75c5b2e155866979c38a6e6d22cede.exewatch2⤵
- Suspicious use of UnmapMainImage
PID:1400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 5043⤵
- Program crash
PID:3668
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5040 -ip 50401⤵PID:5084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1488 -ip 14881⤵PID:1216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1400 -ip 14001⤵PID:3436