Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2023, 05:01

General

  • Target

    file.exe

  • Size

    420KB

  • MD5

    1f2a7a9a140a2c2c1d71eaa232d0af35

  • SHA1

    14651addc7f126a3f985c016e2cd7f087c31fdca

  • SHA256

    d2bf6df63e6a4d0ca6461c83a7c3294bef954eb3364ed27355f90b54bd51417f

  • SHA512

    78111ee9617e42f16fec5a3d3267acde91a46227dc863e00a3ddd17ae87eda52a4a58debfb48eba3f6113473eb9e44dd5e6c98a2ea569d915ca74d36da560e6c

  • SSDEEP

    6144:phvfLMiEDB/7XRi3EpGJTs/1hfuq4d+lEtcCjkBkIvuuOph1FNng6:phHQiUlrYO1hmq4dj6H5uuOdFNnd

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1244
      2⤵
      • Program crash
      PID:3968
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2444 -ip 2444
    1⤵
      PID:1960

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2444-132-0x0000000002D7D000-0x0000000002DB4000-memory.dmp

      Filesize

      220KB

    • memory/2444-133-0x0000000004940000-0x0000000004999000-memory.dmp

      Filesize

      356KB

    • memory/2444-134-0x0000000007340000-0x00000000078E4000-memory.dmp

      Filesize

      5.6MB

    • memory/2444-135-0x0000000000400000-0x0000000002BD1000-memory.dmp

      Filesize

      39.8MB

    • memory/2444-136-0x0000000007900000-0x0000000007F18000-memory.dmp

      Filesize

      6.1MB

    • memory/2444-137-0x0000000007FC0000-0x0000000007FD2000-memory.dmp

      Filesize

      72KB

    • memory/2444-138-0x0000000007FE0000-0x00000000080EA000-memory.dmp

      Filesize

      1.0MB

    • memory/2444-139-0x00000000080F0000-0x000000000812C000-memory.dmp

      Filesize

      240KB

    • memory/2444-140-0x0000000008400000-0x0000000008466000-memory.dmp

      Filesize

      408KB

    • memory/2444-141-0x0000000008AE0000-0x0000000008B72000-memory.dmp

      Filesize

      584KB

    • memory/2444-142-0x0000000008C80000-0x0000000008CF6000-memory.dmp

      Filesize

      472KB

    • memory/2444-143-0x0000000008D40000-0x0000000008D5E000-memory.dmp

      Filesize

      120KB

    • memory/2444-144-0x0000000008DF0000-0x0000000008FB2000-memory.dmp

      Filesize

      1.8MB

    • memory/2444-145-0x0000000008FE0000-0x000000000950C000-memory.dmp

      Filesize

      5.2MB

    • memory/2444-146-0x0000000002D7D000-0x0000000002DB4000-memory.dmp

      Filesize

      220KB

    • memory/2444-147-0x0000000000400000-0x0000000002BD1000-memory.dmp

      Filesize

      39.8MB

    • memory/2444-148-0x0000000002D7D000-0x0000000002DB4000-memory.dmp

      Filesize

      220KB

    • memory/2444-149-0x0000000000400000-0x0000000002BD1000-memory.dmp

      Filesize

      39.8MB