Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2023, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
d19f0086f98905880ddd0262f571a01e_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d19f0086f98905880ddd0262f571a01e_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
d19f0086f98905880ddd0262f571a01e_JC.exe
-
Size
117KB
-
MD5
d19f0086f98905880ddd0262f571a01e
-
SHA1
cadfb5f62c65034887b472d6a7e2dc61e4478cdb
-
SHA256
0e571862727a8a30074ff8cf28237cc24787f6c54adbb4557a4c6f723fa47688
-
SHA512
a40d346dc12ff7e92ce045394c87a5a9be5b5d03d370f5568a33b3e5c05ca3fad74eedb937bf1c670784a3c850f665a9772c1ec4383d1753be8af0ad13f06368
-
SSDEEP
3072:dV2BZVPlFlnxClFvLLcsrHWpjbvO+QfxNIi59DeQp3++5WI/QtO:DQrNFxwj9b6G1fx20Y2u+3QE
Malware Config
Signatures
-
Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\win32dc\Quake3 + patch.exe d19f0086f98905880ddd0262f571a01e_JC.exe File created C:\Windows\win32dc\Silent Hill 4 crack.exe d19f0086f98905880ddd0262f571a01e_JC.exe File opened for modification C:\Windows\win32dc\Silent Hill 4 crack.exe d19f0086f98905880ddd0262f571a01e_JC.exe File created C:\Windows\win32dc\DAoC crack.exe d19f0086f98905880ddd0262f571a01e_JC.exe File opened for modification C:\Windows\win32dc\Quake3 + serial.exe d19f0086f98905880ddd0262f571a01e_JC.exe File created C:\Windows\win32dc\Sims 2 + codes.exe d19f0086f98905880ddd0262f571a01e_JC.exe File opened for modification C:\Windows\win32dc\Silent Hill 4 nocd.exe d19f0086f98905880ddd0262f571a01e_JC.exe File created C:\Windows\win32dc\FlatOut + cdfix.exe d19f0086f98905880ddd0262f571a01e_JC.exe File opened for modification C:\Windows\win32dc\DAoC crack.exe d19f0086f98905880ddd0262f571a01e_JC.exe File created C:\Windows\win32dc\Doom 3_hack.exe d19f0086f98905880ddd0262f571a01e_JC.exe File opened for modification C:\Windows\win32dc\UT2004_patch.exe d19f0086f98905880ddd0262f571a01e_JC.exe File created C:\Windows\win32dc\Silent Hill 4 nocd.exe d19f0086f98905880ddd0262f571a01e_JC.exe File opened for modification C:\Windows\win32dc\Sims 2 + patch.exe d19f0086f98905880ddd0262f571a01e_JC.exe File created C:\Windows\win32dc\Quake3 + serial.exe d19f0086f98905880ddd0262f571a01e_JC.exe File created C:\Windows\win32dc\UT2004_patch.exe d19f0086f98905880ddd0262f571a01e_JC.exe File opened for modification C:\Windows\win32dc\FlatOut + cdfix.exe d19f0086f98905880ddd0262f571a01e_JC.exe File created C:\Windows\win32dc\Sims 2 + patch.exe d19f0086f98905880ddd0262f571a01e_JC.exe File opened for modification C:\Windows\win32dc\Sims 2 + codes.exe d19f0086f98905880ddd0262f571a01e_JC.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4884 4968 WerFault.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\d19f0086f98905880ddd0262f571a01e_JC.exe"C:\Users\Admin\AppData\Local\Temp\d19f0086f98905880ddd0262f571a01e_JC.exe"1⤵
- Drops file in Windows directory
PID:4968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 5042⤵
- Program crash
PID:4884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4968 -ip 49681⤵PID:4472
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD5d19f0086f98905880ddd0262f571a01e
SHA1cadfb5f62c65034887b472d6a7e2dc61e4478cdb
SHA2560e571862727a8a30074ff8cf28237cc24787f6c54adbb4557a4c6f723fa47688
SHA512a40d346dc12ff7e92ce045394c87a5a9be5b5d03d370f5568a33b3e5c05ca3fad74eedb937bf1c670784a3c850f665a9772c1ec4383d1753be8af0ad13f06368