Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 10:05

General

  • Target

    d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9.exe

  • Size

    96KB

  • MD5

    95e321e13ac9f159721cad66c95c5c1a

  • SHA1

    ac55a4495266ddb0ba5e5c4e072a5ad08c3e6415

  • SHA256

    d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9

  • SHA512

    e85d557362df0b93dd0bf7a5de42cd2ae02d5aa9fb772de6c8a073451ecfc15af7ffcaece07a9b73ebd4b474aaa32a500d27c2da0dbeebdb27eadac97c68bd4e

  • SSDEEP

    1536:I8kcu4l7dSZ9T+2mxPAsL/JbuOLZ64ZCPBKbnziw1dVOcwCCQc+VDM+QJtOw/:ecj7k/y2mxB9uMzZCPBK1Dw9Raw/

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9.exe
    "C:\Users\Admin\AppData\Local\Temp\d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Users\Admin\AppData\Local\Temp\d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9.exe
      C:\Users\Admin\AppData\Local\Temp\d1c2c944827b191bd6a871013f5acafdc308649fce7a0024dfe5d056b50312b9.exe
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Users\Admin\AppData\Roaming\taskhost.exe
        C:\Users\Admin\AppData\Roaming\taskhost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Users\Admin\AppData\Roaming\taskhost.exe
          C:\Users\Admin\AppData\Roaming\taskhost.exe
          4⤵
          • Executes dropped EXE
          PID:5004
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 296
          4⤵
          • Program crash
          PID:4900
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 296
      2⤵
      • Program crash
      PID:3380
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2524 -ip 2524
    1⤵
      PID:956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1480 -ip 1480
      1⤵
        PID:4916

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\taskhost.exe

        Filesize

        96KB

        MD5

        9163eccf4f38ee5681d275767d7d9103

        SHA1

        c0975d49b43ad9157f50dd56aac8a5d113ee0775

        SHA256

        2fab982ccb3612e23d1a551606f16fbb32f7ef06e8948453b6bf8434269b4b4b

        SHA512

        b02233591198ed85a0f4da961e4985adc6df8c7844f61c5f10672f89db84da2e8e090786fa53450d0d9c9a1013a11950a0c3a4ca373e9b6880e084fe67c7d2f1

      • C:\Users\Admin\AppData\Roaming\taskhost.exe

        Filesize

        96KB

        MD5

        9163eccf4f38ee5681d275767d7d9103

        SHA1

        c0975d49b43ad9157f50dd56aac8a5d113ee0775

        SHA256

        2fab982ccb3612e23d1a551606f16fbb32f7ef06e8948453b6bf8434269b4b4b

        SHA512

        b02233591198ed85a0f4da961e4985adc6df8c7844f61c5f10672f89db84da2e8e090786fa53450d0d9c9a1013a11950a0c3a4ca373e9b6880e084fe67c7d2f1

      • C:\Users\Admin\AppData\Roaming\taskhost.exe

        Filesize

        96KB

        MD5

        9163eccf4f38ee5681d275767d7d9103

        SHA1

        c0975d49b43ad9157f50dd56aac8a5d113ee0775

        SHA256

        2fab982ccb3612e23d1a551606f16fbb32f7ef06e8948453b6bf8434269b4b4b

        SHA512

        b02233591198ed85a0f4da961e4985adc6df8c7844f61c5f10672f89db84da2e8e090786fa53450d0d9c9a1013a11950a0c3a4ca373e9b6880e084fe67c7d2f1

      • memory/2548-135-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/2548-134-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/2548-133-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/2548-144-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/5004-142-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/5004-143-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB

      • memory/5004-145-0x0000000000400000-0x000000000042A000-memory.dmp

        Filesize

        168KB