Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

678783b168...82.exe

windows7-x64

1

678783b168...82.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2023, 22:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe

  • Size

    1.3MB

  • MD5

    511dca10841efbbe62b3e93425e30837

  • SHA1

    fcfb71fc5fb9f516812fb9bad86ba11ecec122b8

  • SHA256

    678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782

  • SHA512

    1638b940277fe4ca07e8e790cb7e1764f6909d9e55dcf60923cec7a3076077781bf709166e74949f9b2a6e251f9e57b3704b00c4f28943e3ec70457886ba31f0

  • SSDEEP

    24576:UcvaDKBaZSeA/+RvgswfkNoKUCuO5az/rhPV52oh:U1Q2RgkNo7Fz/VPV/

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe
    "C:\Users\Admin\AppData\Local\Temp\678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3588
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 2004
      2⤵
      • Program crash
      PID:1076
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 2004
      2⤵
      • Program crash
      PID:5104
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3588 -ip 3588
    1⤵
      PID:260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3588 -ip 3588
      1⤵
        PID:4820

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Jnns.Config
        Filesize

        2KB

        MD5

        6fc2e854a6a6d647b767c5082b297c84

        SHA1

        cf6162a2dc641132a46d922b9ecf1836441baacc

        SHA256

        43a5f03128eb5f1eb2a48e8b24403e46747f40033fd4793f4735546f6637e8e0

        SHA512

        435edadb71089f70161a520547a7cd7e7c2c0a42d93ef8d073cc3e2ec366d78398f9fc7e86177b692cb163919904983567da56a4cf8d767747544b8b7e6cf35f

        Download Submit