Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    313s
  • max time network
    374s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 21:58

General

  • Target

    bd9079d295c7a906d1b0bbe5a2f975cf23512a768b8aa5b06de4f30c3da2998e.exe

  • Size

    385KB

  • MD5

    5977a8be127803556325945452a6dcfb

  • SHA1

    d1d72726b922cc0f0a88981f7cc3e6c776c582f8

  • SHA256

    bd9079d295c7a906d1b0bbe5a2f975cf23512a768b8aa5b06de4f30c3da2998e

  • SHA512

    dcd71602a2742c45bd5837f4b77ea6a5f3ad27d96adb545c6b2065983da2e013a4957d8063a63ae8596e7f9ea22f24feeb5528706ea00b1067557873c8ac3539

  • SSDEEP

    6144:MRAhhJxX7bNIAROzTb2uuXp+7qxQ3rfvQ2ZblmR4lQOqBpFbmbqsykpAMoVU:UsAAM2dZYVvQ6lmCl/qBTmfz

Score
10/10

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd9079d295c7a906d1b0bbe5a2f975cf23512a768b8aa5b06de4f30c3da2998e.exe
    "C:\Users\Admin\AppData\Local\Temp\bd9079d295c7a906d1b0bbe5a2f975cf23512a768b8aa5b06de4f30c3da2998e.exe"
    1⤵
    • Modifies system executable filetype association
    • Modifies Installed Components in the registry
    • Adds Run key to start application
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:4040
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 700
      2⤵
      • Program crash
      PID:3180
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4040 -ip 4040
    1⤵
      PID:3328

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4040-132-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/4040-133-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB