Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe
Resource
win10v2004-20220812-en
General
-
Target
ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe
-
Size
240KB
-
MD5
b9d564eb2bd9699c04fc0239bbb3b814
-
SHA1
9cfc9f538f747536158da96148ba8deec9fc4064
-
SHA256
ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031
-
SHA512
93b564486b640d21ff2955fd0431f4f86991d61c8e901681933221deb2104f22faf596675bca2297ecab108af864be5dcfcca8c2f9d61b0f8d573a7b0fe5842a
-
SSDEEP
6144:LWOipIA/VeF4qliVO1P5AiTNuKdJhNFEzX:LfipIA/Ve2qYIbTED
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4112 2296 WerFault.exe 26 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2296 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe"C:\Users\Admin\AppData\Local\Temp\ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:2296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 5842⤵
- Program crash
PID:4112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2296 -ip 22961⤵PID:3664