Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    104s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2023, 22:00

General

  • Target

    file.exe

  • Size

    332KB

  • MD5

    aa727e598ba7c5a947124cd5fd93ed6d

  • SHA1

    0de18ccace13691011506ddaad4ab72a2731bce3

  • SHA256

    62a2221333631de6cf65db3fa3e2650947b23f24ea172a3ea998d77baa0cb270

  • SHA512

    80221cec662cc89d12993edf8b289b89a4acfa481712d3f036a2d4f9b2c4f1ebb16c0a0a02f6b12d9a7ea0a9e6e5720ff3d797835f4fd3426eac9c97238975ad

  • SSDEEP

    6144:JvYd3tEPMde9vknpuXdSovd4OUHtDtUP:Jv8ckUXdpdCNDW

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2796
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 1240
      2⤵
      • Program crash
      PID:2552
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2796 -ip 2796
    1⤵
      PID:2744

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2796-134-0x0000000006D00000-0x00000000072A4000-memory.dmp

      Filesize

      5.6MB

    • memory/2796-135-0x0000000004300000-0x000000000433D000-memory.dmp

      Filesize

      244KB

    • memory/2796-136-0x0000000006CF0000-0x0000000006D00000-memory.dmp

      Filesize

      64KB

    • memory/2796-137-0x0000000006CF0000-0x0000000006D00000-memory.dmp

      Filesize

      64KB

    • memory/2796-138-0x00000000072B0000-0x00000000078C8000-memory.dmp

      Filesize

      6.1MB

    • memory/2796-139-0x0000000006CD0000-0x0000000006CE2000-memory.dmp

      Filesize

      72KB

    • memory/2796-140-0x0000000007910000-0x0000000007A1A000-memory.dmp

      Filesize

      1.0MB

    • memory/2796-141-0x0000000007A20000-0x0000000007A5C000-memory.dmp

      Filesize

      240KB

    • memory/2796-142-0x0000000006CF0000-0x0000000006D00000-memory.dmp

      Filesize

      64KB

    • memory/2796-143-0x0000000000400000-0x000000000257F000-memory.dmp

      Filesize

      33.5MB

    • memory/2796-144-0x0000000006CF0000-0x0000000006D00000-memory.dmp

      Filesize

      64KB

    • memory/2796-145-0x0000000006CF0000-0x0000000006D00000-memory.dmp

      Filesize

      64KB

    • memory/2796-146-0x0000000006CF0000-0x0000000006D00000-memory.dmp

      Filesize

      64KB

    • memory/2796-148-0x0000000007E80000-0x0000000007EE6000-memory.dmp

      Filesize

      408KB

    • memory/2796-149-0x0000000008530000-0x00000000085C2000-memory.dmp

      Filesize

      584KB

    • memory/2796-150-0x0000000008610000-0x0000000008686000-memory.dmp

      Filesize

      472KB

    • memory/2796-151-0x00000000086E0000-0x00000000086FE000-memory.dmp

      Filesize

      120KB

    • memory/2796-152-0x0000000008880000-0x0000000008A42000-memory.dmp

      Filesize

      1.8MB

    • memory/2796-153-0x0000000008A70000-0x0000000008F9C000-memory.dmp

      Filesize

      5.2MB

    • memory/2796-155-0x0000000000400000-0x000000000257F000-memory.dmp

      Filesize

      33.5MB