Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2023, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe
Resource
win7-20220901-en
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe
Resource
win10v2004-20221111-en
4 signatures
150 seconds
General
-
Target
26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe
-
Size
217KB
-
MD5
15dec13bdd63907e5fcda9e7e621e1a2
-
SHA1
26154e506c39c8b4681cc38a19c87249f8ce3ae6
-
SHA256
569d9035ed630038599104bb8c770473e8cff91b3554a1deb4f4028b578429d3
-
SHA512
4a14c459e417d37cb841805e125c745b4bdbabd1611bbad7813b20cef639e9af99f981c16f94f7ab41765c34e6a1fa053f87a2755ce613db1d17171d72437586
-
SSDEEP
6144:AntQ758qxOopgCXDww83kI5vAOI3F5VyLchfn09c:AtQ758qxOopgzvuf0G
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2600 set thread context of 1176 2600 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 83 -
Program crash 2 IoCs
pid pid_target Process procid_target 2172 1176 WerFault.exe 83 3600 2600 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1176 2600 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 83 PID 2600 wrote to memory of 1176 2600 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 83 PID 2600 wrote to memory of 1176 2600 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 83 PID 2600 wrote to memory of 1176 2600 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 83 PID 2600 wrote to memory of 1176 2600 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe"C:\Users\Admin\AppData\Local\Temp\26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:1176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1176 -s 163⤵
- Program crash
PID:2172
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 2122⤵
- Program crash
PID:3600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1176 -ip 11761⤵PID:3344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2600 -ip 26001⤵PID:2320