Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
16a0e56cbd5272ab995c8108cd84a7b8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
16a0e56cbd5272ab995c8108cd84a7b8.exe
Resource
win10v2004-20231215-en
General
-
Target
16a0e56cbd5272ab995c8108cd84a7b8.exe
-
Size
755KB
-
MD5
16a0e56cbd5272ab995c8108cd84a7b8
-
SHA1
ea5a3310989a20baf177072fc28f50837745f66e
-
SHA256
05ec270b1cfc17131f2aa5d15ec3cc415dba90a33531cb3843bdca288363dc56
-
SHA512
f3ea3507400077c28cd5043a950ef3dea5c615128736a71dc9bfb1b03de9ee027a3c5006731759ef9f83699421169520ffb7a06a95c3fa01595e33a6232c8cd4
-
SSDEEP
12288:e4H73i8fZOMLtjJ6ogl6JMv8Vnz9iqRULkqT9xAltq/B16XZvPZ/TNVrHn7X:esji8RvNslNv8VnzpUoEeO/nIRZ/Tf7X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2084 setup.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 3304 2084 WerFault.exe 88 4740 2084 WerFault.exe 88 2240 2084 WerFault.exe 88 -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4472 16a0e56cbd5272ab995c8108cd84a7b8.exe 4472 16a0e56cbd5272ab995c8108cd84a7b8.exe 2084 setup.exe 2084 setup.exe 2084 setup.exe 2084 setup.exe 2084 setup.exe 2084 setup.exe 2084 setup.exe 2084 setup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4472 wrote to memory of 2084 4472 16a0e56cbd5272ab995c8108cd84a7b8.exe 88 PID 4472 wrote to memory of 2084 4472 16a0e56cbd5272ab995c8108cd84a7b8.exe 88 PID 4472 wrote to memory of 2084 4472 16a0e56cbd5272ab995c8108cd84a7b8.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\16a0e56cbd5272ab995c8108cd84a7b8.exe"C:\Users\Admin\AppData\Local\Temp\16a0e56cbd5272ab995c8108cd84a7b8.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe relaunch2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2084 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 21563⤵
- Program crash
PID:3304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 21643⤵
- Program crash
PID:4740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 21763⤵
- Program crash
PID:2240
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2084 -ip 20841⤵PID:1972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2084 -ip 20841⤵PID:3240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2084 -ip 20841⤵PID:5088
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
755KB
MD516a0e56cbd5272ab995c8108cd84a7b8
SHA1ea5a3310989a20baf177072fc28f50837745f66e
SHA25605ec270b1cfc17131f2aa5d15ec3cc415dba90a33531cb3843bdca288363dc56
SHA512f3ea3507400077c28cd5043a950ef3dea5c615128736a71dc9bfb1b03de9ee027a3c5006731759ef9f83699421169520ffb7a06a95c3fa01595e33a6232c8cd4