Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

2077e74154...fc.exe

windows7-x64

1

2077e74154...fc.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 23:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2077e74154e03917dfd83e1d1b3ea3fc.exe

  • Size

    3.0MB

  • MD5

    2077e74154e03917dfd83e1d1b3ea3fc

  • SHA1

    d40802db64ea9087541d469ec89361fd7c343fe6

  • SHA256

    d620e22f1ebf5e39e6671fbb877683defc9e97a3a08eacd265e4da3b84b547ec

  • SHA512

    87dbb336203fe3b1465c88ccbc49f3244c003102f55b38caf8efb019e64eaf477f8bbbb3103cebc5774e89dfd52f135688467000f9f73d31486d347debf22ec4

  • SSDEEP

    49152:4HZ2s3FMX+i9crDcRLsDENLuYP6Tbs6bGEHXXueUGnkUmKGXvhGMB/U/8KiV000/:4l3FMui9wE4YNyYCTXbNHXXueUGnkUmK

Score
3/10

Malware Config

Signatures

  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2077e74154e03917dfd83e1d1b3ea3fc.exe
    "C:\Users\Admin\AppData\Local\Temp\2077e74154e03917dfd83e1d1b3ea3fc.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 952
      2⤵
      • Program crash
      PID:3992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 948
      2⤵
      • Program crash
      PID:2500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 844
      2⤵
      • Program crash
      PID:748
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 980 -ip 980
    1⤵
      PID:1776
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 980 -ip 980
      1⤵
        PID:1484
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 980 -ip 980
        1⤵
          PID:4744

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/980-0-0x0000000000400000-0x0000000001314000-memory.dmp

          Filesize

          15.1MB

          Download

        • memory/980-1-0x0000000000400000-0x0000000001314000-memory.dmp

          Filesize

          15.1MB

          Download

        • memory/980-2-0x0000000000400000-0x0000000001314000-memory.dmp

          Filesize

          15.1MB

          Download

        • memory/980-3-0x0000000000400000-0x0000000001314000-memory.dmp

          Filesize

          15.1MB

          Download

        • memory/980-4-0x0000000000400000-0x0000000001314000-memory.dmp

          Filesize

          15.1MB

          Download

        • memory/980-9-0x0000000000400000-0x0000000001314000-memory.dmp

          Filesize

          15.1MB

          Download

        • memory/980-12-0x0000000000400000-0x0000000001314000-memory.dmp

          Filesize

          15.1MB

          Download

        • memory/980-15-0x0000000000400000-0x0000000001314000-memory.dmp

          Filesize

          15.1MB

          Download