Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 02:35
Static task
static1
Behavioral task
behavioral1
Sample
24ab578c2502650cd3cd0b129f53056b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
24ab578c2502650cd3cd0b129f53056b.exe
Resource
win10v2004-20231215-en
General
-
Target
24ab578c2502650cd3cd0b129f53056b.exe
-
Size
505KB
-
MD5
24ab578c2502650cd3cd0b129f53056b
-
SHA1
c0af7027f89751406a9bb21d14e4b7823b41f8c5
-
SHA256
3f490362db7a369ba1ce7693425e5a0c841c549797022658d7bb94a082011c33
-
SHA512
2298493510474c35896e5615d65770a259bfd0fad86fbe117699fb471e8657f2428d7d5562652051c1ec8e6521c150890354b7a8a80ef1e71c1e286b4e8e8c5c
-
SSDEEP
12288:/zy6rRxEHdjDblNMi7Vhdyr1gqfZRqK6JVd/Ml4i/2ZBRdOFcbG/o:e6rTkRblLwqqfZRVUVd/NrBRs2bd
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process 4532 4396 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24ab578c2502650cd3cd0b129f53056b.exe"C:\Users\Admin\AppData\Local\Temp\24ab578c2502650cd3cd0b129f53056b.exe"1⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\ysf.exe"C:\Users\Admin\AppData\Local\Temp\ysf.exe"2⤵PID:4396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4396 -ip 43961⤵PID:1620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 2241⤵
- Program crash
PID:4532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5401cd4e5dac275f5a1a8065a01607699
SHA11e4e90ad38d2b85d417311bc5d1e0d36dc6875f7
SHA256b342c9569a99a9de842a608dc4ffd6c0fe85c24f0dca3dcb0c79b4d3aff34643
SHA51246cc4c7ee4c7f3026a1fceb70d6f7bdc1a4d1a1f76dde5bdbe915b03b9d57df9906a542ffe4afad38b420b5d5e72da03b93a1af946e51b4b88252f3edea78920