Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2023, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe
Resource
win7-20220812-en
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe
Resource
win10v2004-20220812-en
4 signatures
150 seconds
General
-
Target
26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe
-
Size
217KB
-
MD5
15dec13bdd63907e5fcda9e7e621e1a2
-
SHA1
26154e506c39c8b4681cc38a19c87249f8ce3ae6
-
SHA256
569d9035ed630038599104bb8c770473e8cff91b3554a1deb4f4028b578429d3
-
SHA512
4a14c459e417d37cb841805e125c745b4bdbabd1611bbad7813b20cef639e9af99f981c16f94f7ab41765c34e6a1fa053f87a2755ce613db1d17171d72437586
-
SSDEEP
6144:AntQ758qxOopgCXDww83kI5vAOI3F5VyLchfn09c:AtQ758qxOopgzvuf0G
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4588 set thread context of 4884 4588 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 82 -
Program crash 2 IoCs
pid pid_target Process procid_target 4544 4588 WerFault.exe 80 1380 4884 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4588 wrote to memory of 4884 4588 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 82 PID 4588 wrote to memory of 4884 4588 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 82 PID 4588 wrote to memory of 4884 4588 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 82 PID 4588 wrote to memory of 4884 4588 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 82 PID 4588 wrote to memory of 4884 4588 26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe"C:\Users\Admin\AppData\Local\Temp\26154e506c39c8b4681cc38a19c87249f8ce3ae6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:4884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 163⤵
- Program crash
PID:1380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 1362⤵
- Program crash
PID:4544
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4588 -ip 45881⤵PID:1316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4884 -ip 48841⤵PID:1176