Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
13/07/2023, 23:11
General
-
Target
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
-
Size
480KB
-
MD5
b44634d90a9ff2ed8a9d0304c11bf612
-
SHA1
8f72e02dcbd87a4c1b880d349e34e0deb8e7bdd4
-
SHA256
27d3378f41d3bd82d84544f7331856001a5fca259b6ef9001c15cdc43207c73e
-
SHA512
7e48e19817a132c8c29f56c271865ad7ef375291229e9b844c3d3c7ff8927b23fe4eb87494ef89f3dae0e1795648ae910e576ca0c42c231c15aaca60bb619239
-
SSDEEP
6144:iWWPaCGkGGCBJKeNm1VbeuJCeU2HM7R+mzZUxrKkhhcghPrQANJRjiP6EQ6a9k7v:ReGkGJN8VyUxrvoZgJRjJ6a9TgS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Original\b44634d90a9ff2ed8a9d0304c11bf612.exe"C:\Users\Admin\AppData\Local\Temp\Original\b44634d90a9ff2ed8a9d0304c11bf612.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\GNewDTxgNKQVuGF.exeC:\Users\Admin\AppData\Local\Temp\Original\b44634d90a9ff2ed8a9d0304c11bf612.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 7483⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1492 -ip 14921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480KB
MD5b44634d90a9ff2ed8a9d0304c11bf612
SHA18f72e02dcbd87a4c1b880d349e34e0deb8e7bdd4
SHA25627d3378f41d3bd82d84544f7331856001a5fca259b6ef9001c15cdc43207c73e
SHA5127e48e19817a132c8c29f56c271865ad7ef375291229e9b844c3d3c7ff8927b23fe4eb87494ef89f3dae0e1795648ae910e576ca0c42c231c15aaca60bb619239
-
Filesize
480KB
MD5b44634d90a9ff2ed8a9d0304c11bf612
SHA18f72e02dcbd87a4c1b880d349e34e0deb8e7bdd4
SHA25627d3378f41d3bd82d84544f7331856001a5fca259b6ef9001c15cdc43207c73e
SHA5127e48e19817a132c8c29f56c271865ad7ef375291229e9b844c3d3c7ff8927b23fe4eb87494ef89f3dae0e1795648ae910e576ca0c42c231c15aaca60bb619239
-
Filesize
484KB
-
Filesize
8KB
-
Filesize
484KB
-
Filesize
484KB