Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 08:20

General

  • Target

    5f5d740ac94ad3a9cbc2f097bb34b109.exe

  • Size

    948KB

  • MD5

    5f5d740ac94ad3a9cbc2f097bb34b109

  • SHA1

    1dfe90d3168f31557368c1f5e129992229084a18

  • SHA256

    e4c89dda2cdad57add1594398a9c3de4b27678d631188c06352a51f47d4b0536

  • SHA512

    28fb7dedb7316c98a19d29dc4337bbb21fea16ce96f65845c49c6ba839c6a34593bac24deeed619970d6cb9bc7be8ab758a3e3da1f295fe0d8ef352ea1e34f33

  • SSDEEP

    24576:9nhpTOZbUX28RO/IVJagjM6+dYwrbCInZ/g9wMCmYs:dOU+sJ7QRdnnwRu

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • Modifies registry class 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f5d740ac94ad3a9cbc2f097bb34b109.exe
    "C:\Users\Admin\AppData\Local\Temp\5f5d740ac94ad3a9cbc2f097bb34b109.exe"
    1⤵
    • Enumerates connected drives
    • Modifies registry class
    PID:3180
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 912
      2⤵
      • Program crash
      PID:3836
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 912
      2⤵
      • Program crash
      PID:372
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 976
      2⤵
      • Program crash
      PID:3284
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 948
      2⤵
      • Program crash
      PID:4400
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 696
      2⤵
      • Program crash
      PID:2540
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1288
      2⤵
      • Program crash
      PID:3116
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1348
      2⤵
      • Program crash
      PID:1912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3180 -ip 3180
    1⤵
      PID:3984
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3180 -ip 3180
      1⤵
        PID:2824
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3180 -ip 3180
        1⤵
          PID:524
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3180 -ip 3180
          1⤵
            PID:3672
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3180 -ip 3180
            1⤵
              PID:1348
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3180 -ip 3180
              1⤵
                PID:1944
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3180 -ip 3180
                1⤵
                  PID:4004

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/3180-0-0x0000000000010000-0x00000000003EA000-memory.dmp

                  Filesize

                  3.9MB

                • memory/3180-1-0x0000000002590000-0x0000000002591000-memory.dmp

                  Filesize

                  4KB

                • memory/3180-2-0x0000000000010000-0x00000000003EA000-memory.dmp

                  Filesize

                  3.9MB

                • memory/3180-3-0x0000000002590000-0x0000000002591000-memory.dmp

                  Filesize

                  4KB

                • memory/3180-4-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

                  Filesize

                  4KB

                • memory/3180-5-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

                  Filesize

                  4KB