Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
Resource
win10v2004-20220812-en
General
-
Target
548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
-
Size
3.3MB
-
MD5
221a71ddde12b86b2a1a2b3a63fd2280
-
SHA1
6553c87b19df0b79dc8008d157f3bcc5bde011c5
-
SHA256
548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260
-
SHA512
09515a5b7a6e7d5e6e4cd7fbbaa4bf70a0d71886ce754254f5146a7f9fb331fe663e9d42a0ef427c56de98b46ad4f0bacd05030429c8fac67ee09d676375170e
-
SSDEEP
49152:8aBfrnFxwuCpdg037hG1oLqZXCJAQ7eEgZkZBcePYDj9k3VGllCTTfb/JeSlFGqA:8aBnf0395LiAAdPSYlk3PTv3lFGqvY
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4652 4308 WerFault.exe 81 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe 4308 548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe"C:\Users\Admin\AppData\Local\Temp\548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 13842⤵
- Program crash
PID:4652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4308 -ip 43081⤵PID:1600
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5d0f2416807f04c559e6394a0a4c7f1d1
SHA17df43ffa3716156d282b1e37d12dd1122f0a762c
SHA2560fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc
SHA5128199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799
-
Filesize
71KB
MD540e3899b01616fcaa8f9a6653504dd8b
SHA1d890396f782230078f0e19e8d7d91091c4d0a38b
SHA2560728576d67e8522158549c819de8206dcb886f3ac2997d5a962449bf8b671090
SHA512256a0d95d567708213980fc24a90ada673f9a3bc7692bf30147c42a11e4cf286ccb92de2f360d9056e80e170cbdc06f715676f6f7678743f3e86fa99eff4aa42