Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2023, 22:56

General

  • Target

    pr923071.exe

  • Size

    405KB

  • MD5

    3bad98a281a91da6db58e85316ce1a02

  • SHA1

    443480c0b2787a6e31966e0aa468c3893d055049

  • SHA256

    e5a1db0d5caeb1d7661ae6e7f1b5708dd8797708490abf45bf759f2ab060ba52

  • SHA512

    fbd9310340d64716968419de2c27b661761c01989f03866c15dbb8e3d87f40fa08adf139ca954dfd21a2a5f71254cabf7675771a80486fbb1d133eb158aaad3b

  • SSDEEP

    6144:oQWwbRayvL6xJxnl8A9vI+fOcR7v+NyjhAfKtTk:zWwMyz6xJxl80vI+fOcRT+NkOfKtTk

Score
10/10

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pr923071.exe
    "C:\Users\Admin\AppData\Local\Temp\pr923071.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Windows security modification
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 1000
      2⤵
      • Program crash
      PID:4136
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 444 -ip 444
    1⤵
      PID:1704

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/444-134-0x0000000000990000-0x00000000009BD000-memory.dmp

      Filesize

      180KB

    • memory/444-135-0x0000000004F80000-0x0000000004F90000-memory.dmp

      Filesize

      64KB

    • memory/444-136-0x0000000004F90000-0x0000000005534000-memory.dmp

      Filesize

      5.6MB

    • memory/444-138-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-137-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-140-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-142-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-144-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-146-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-148-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-150-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-152-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-154-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-156-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-158-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-160-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-162-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-164-0x0000000002A30000-0x0000000002A42000-memory.dmp

      Filesize

      72KB

    • memory/444-165-0x0000000000400000-0x000000000080A000-memory.dmp

      Filesize

      4.0MB

    • memory/444-167-0x0000000000400000-0x000000000080A000-memory.dmp

      Filesize

      4.0MB