Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
04/12/2022, 11:40
General
-
Target
f2f20dcab4a86bcd702000a74be664335650b5e8f64d83b44b64410cf79fd7e2.exe
-
Size
442KB
-
MD5
a29b558640e736db3d4bb8d8011ae22e
-
SHA1
34c140b89cc9144f293d3c0529e282a94df23bf6
-
SHA256
f2f20dcab4a86bcd702000a74be664335650b5e8f64d83b44b64410cf79fd7e2
-
SHA512
b69797b066255f7c679c3d63fda80fcc94c1e7e83703b5c829bd2bff83e232e873ff9c04376205abee29824fe7fe89ca24bbea902256bce7495fac9763d9b1e6
-
SSDEEP
6144:DV5M4mPieHwaPSFZWERgFQuxYKgk/2MoVc+kOddfWI0s9POHbOQCStUshpwLnaRP:BvmPieRPSFQuOQ0WkD92j9Py15tFwL+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2f20dcab4a86bcd702000a74be664335650b5e8f64d83b44b64410cf79fd7e2.exe"C:\Users\Admin\AppData\Local\Temp\f2f20dcab4a86bcd702000a74be664335650b5e8f64d83b44b64410cf79fd7e2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pLmNiFm24512\pLmNiFm24512.exe"C:\ProgramData\pLmNiFm24512\pLmNiFm24512.exe" "C:\Users\Admin\AppData\Local\Temp\f2f20dcab4a86bcd702000a74be664335650b5e8f64d83b44b64410cf79fd7e2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 13083⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 828 -s 12762⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 828 -ip 8281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4328 -ip 43281⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD5a1490485ce08208d06135c3513286783
SHA12fae32ac0805e3ffd6590f13d5c8a4a6c49c2768
SHA256aca7abcaf31f6913d357cc7bd0dddc7555f7d6001ec45b03f837dc578f47b987
SHA512fbb60c87899b3684da8a19d07b46478e82dab94a59025b4d8e4159ec1999fca1b255b135a2905aaff45b3796ef00206166e47675e5f1ae27bba85189d0bb999b
-
Filesize
442KB
MD5a1490485ce08208d06135c3513286783
SHA12fae32ac0805e3ffd6590f13d5c8a4a6c49c2768
SHA256aca7abcaf31f6913d357cc7bd0dddc7555f7d6001ec45b03f837dc578f47b987
SHA512fbb60c87899b3684da8a19d07b46478e82dab94a59025b4d8e4159ec1999fca1b255b135a2905aaff45b3796ef00206166e47675e5f1ae27bba85189d0bb999b
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
2.5MB
-
Filesize
632KB
-
Filesize
2.5MB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
316KB
-
Filesize
740KB
-
Filesize
740KB