Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

fl_patch_i...63.exe

windows7-x64

7

fl_patch_i...63.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    101s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2023, 17:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fl_patch_installer_20_7_2_1863.exe

  • Size

    111.1MB

  • MD5

    d4ba52ac1ac6bcb16c616ea369058c80

  • SHA1

    cc61da8d29b59a239f680e877c0699435bb18f62

  • SHA256

    405f028aa8a057162a9ae7e409261bf8cbd623f0568235924c93db7f95b8f409

  • SHA512

    cf7b38c1158a5eb78c26cbd4ccbec9d724ba4930125009348cab3341a356207bce54179907f3f0955ba9c8e12a5e25edbf22385288b2da50f24c7457e36b9382

  • SSDEEP

    3145728:YXXSmgoAU2HahqHaO5re0aa9PepTOI2dBa6:YHSNoP2Hahq6O5reHaR7IMh

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fl_patch_installer_20_7_2_1863.exe
    "C:\Users\Admin\AppData\Local\Temp\fl_patch_installer_20_7_2_1863.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4140
    • C:\Users\Admin\AppData\Local\Temp\is-64U61.tmp\fl_patch_installer_20_7_2_1863.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-64U61.tmp\fl_patch_installer_20_7_2_1863.tmp" /SL5="$B004C,116119095,125440,C:\Users\Admin\AppData\Local\Temp\fl_patch_installer_20_7_2_1863.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:1952
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 444 -p 1460 -ip 1460
    1⤵
      PID:2796
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1460 -s 1760
      1⤵
      • Program crash
      PID:2640

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\is-64U61.tmp\fl_patch_installer_20_7_2_1863.tmp
      Filesize

      1.1MB

      MD5

      006c402fd22016b5a5a1c2180ca5ccc9

      SHA1

      dc8dae24ef11181d145c8d9f6f245f3b67a3e1d0

      SHA256

      5b246db2dfc1a5d000b0662e2a58e1cb9f89fdc87945597ec1e1f2f245fd7898

      SHA512

      caea20f48421f7918c9ead0316decba60460c74ff878666e0a48ae1e5b2eb41a37b03c1a59bc3aa416990e49cae155e19894461c28c225f4f9b42e184db289b1

      Download Submit

    • memory/4140-132-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

      Download

    • memory/4140-136-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

      Download

    • memory/4140-137-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

      Download