Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2023, 14:25
Static task
static1
General
-
Target
4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe
-
Size
100KB
-
MD5
ffd328a800cfc6f8a70e0d744a1edf5a
-
SHA1
90e23b2a82e75d5beeddf7507245a4d48fe12be2
-
SHA256
4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594
-
SHA512
2cf2beeaabe2b160b4dccce5c6aa1dcea7e20bb16574cc5a41f6931964df9579975f140c70281c63e616a401cc31a2eb7659d01e955ca869c2967f48c8b624ba
-
SSDEEP
1536:5p6kFya9c7Ok/YNQTSgB75eGFri7jyXX9di2YTHLYjzDm:TVBQz1ri7jyHxYTHcj/
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4244 set thread context of 4520 4244 4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe 84 -
Program crash 1 IoCs
pid pid_target Process procid_target 4432 4244 WerFault.exe 81 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4520 AppLaunch.exe 4520 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4520 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4244 wrote to memory of 4520 4244 4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe 84 PID 4244 wrote to memory of 4520 4244 4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe 84 PID 4244 wrote to memory of 4520 4244 4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe 84 PID 4244 wrote to memory of 4520 4244 4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe 84 PID 4244 wrote to memory of 4520 4244 4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe"C:\Users\Admin\AppData\Local\Temp\4e8d6e890bfce94a077e35757eea894dd85be51e781d68d191a526aabe9ee594.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 1482⤵
- Program crash
PID:4432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4244 -ip 42441⤵PID:4424