Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 05:26
Static task
static1
Behavioral task
behavioral1
Sample
52a7e45e54440445ff3a3470dff1e1d9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
52a7e45e54440445ff3a3470dff1e1d9.exe
Resource
win10v2004-20231215-en
General
-
Target
52a7e45e54440445ff3a3470dff1e1d9.exe
-
Size
193KB
-
MD5
52a7e45e54440445ff3a3470dff1e1d9
-
SHA1
e784a3f7ae5ae0b3f6542352246f156629ec6daf
-
SHA256
8323ef34175470f500c16e422a74718b0ec585dfee2fd7b61da3e4748a70761d
-
SHA512
8139adb97784ead0ed44b4cda6d56ef86b3e208fe70da7a910d1e8f914e7d12dd940c745c4b925727940d1ed55177afcfcbf001754ef853b35c6c98da29e257c
-
SSDEEP
3072:P/uSnUuEgbB3cTlji/6kSM81gcyD63BgFbBdH6lgyFhMTBlp:/bB3j/6k8/yWS0uy8lp
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4720 HelpMe.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\HelpMe.exe 52a7e45e54440445ff3a3470dff1e1d9.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 4912 4720 WerFault.exe 91 2444 4720 WerFault.exe 91 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4684 52a7e45e54440445ff3a3470dff1e1d9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4684 wrote to memory of 4720 4684 52a7e45e54440445ff3a3470dff1e1d9.exe 91 PID 4684 wrote to memory of 4720 4684 52a7e45e54440445ff3a3470dff1e1d9.exe 91 PID 4684 wrote to memory of 4720 4684 52a7e45e54440445ff3a3470dff1e1d9.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\52a7e45e54440445ff3a3470dff1e1d9.exe"C:\Users\Admin\AppData\Local\Temp\52a7e45e54440445ff3a3470dff1e1d9.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Executes dropped EXE
PID:4720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 2523⤵
- Program crash
PID:4912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 2643⤵
- Program crash
PID:2444
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4720 -ip 47201⤵PID:2808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4720 -ip 47201⤵PID:4540
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5461b689a27409738905d44882e94e5f6
SHA17d628e15b2f6ef08f704f9154d26794a09df2c92
SHA256dcb5f27f4431eb20034fcdf7dc4a1d4ad3d9d5255b54e3a1cd94d861ad491b8c
SHA512e54c4298e1f3e7d947f4f941b7fe459a3bc74b464974f95a8fc4623504e1c4b186a46a323a99239a91349a5d72ac15b5a562a36ef5c72f855823cc9c5c08bbe7