Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
99s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
01/02/2023, 14:22
General
-
Target
Setup.exe
-
Size
17.5MB
-
MD5
8be316ace6f4c4d501fc27cbe2558871
-
SHA1
c4a2cd32b90a4d3fca1328cc10dc0d9996d9dded
-
SHA256
1aa500d0e87c1ecb35553db91c8b96029ff89feb1a4c0fb06b6c0238700d83b6
-
SHA512
9153b1dc081ad891b15f163ffe570a0b02ce5ef18828c537f94cfcd61e1d7b8ac448bcaa4257b64428c901c9494934e0bca7d825d0c689dad1badce7325c896c
-
SSDEEP
49152:mwXXV7ULoZ67ys/Twlsqjw1fbVrhVugEpwPxGkYyLw7y1wV+nFy7rNIznFCyT5jU:moFU1f1SgnGXd7y1wVmFdT5c
Score
8/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 6003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4012 -ip 40121⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.6MB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB