Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

52a7e45e54...d9.exe

windows7-x64

7

52a7e45e54...d9.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2024, 05:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    52a7e45e54440445ff3a3470dff1e1d9.exe

  • Size

    193KB

  • MD5

    52a7e45e54440445ff3a3470dff1e1d9

  • SHA1

    e784a3f7ae5ae0b3f6542352246f156629ec6daf

  • SHA256

    8323ef34175470f500c16e422a74718b0ec585dfee2fd7b61da3e4748a70761d

  • SHA512

    8139adb97784ead0ed44b4cda6d56ef86b3e208fe70da7a910d1e8f914e7d12dd940c745c4b925727940d1ed55177afcfcbf001754ef853b35c6c98da29e257c

  • SSDEEP

    3072:P/uSnUuEgbB3cTlji/6kSM81gcyD63BgFbBdH6lgyFhMTBlp:/bB3j/6k8/yWS0uy8lp

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\52a7e45e54440445ff3a3470dff1e1d9.exe
    "C:\Users\Admin\AppData\Local\Temp\52a7e45e54440445ff3a3470dff1e1d9.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Executes dropped EXE
      PID:4720
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 252
        3⤵
        • Program crash
        PID:4912
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 264
        3⤵
        • Program crash
        PID:2444
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4720 -ip 4720
    1⤵
      PID:2808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4720 -ip 4720
      1⤵
        PID:4540

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\HelpMe.exe
        Filesize

        69KB

        MD5

        461b689a27409738905d44882e94e5f6

        SHA1

        7d628e15b2f6ef08f704f9154d26794a09df2c92

        SHA256

        dcb5f27f4431eb20034fcdf7dc4a1d4ad3d9d5255b54e3a1cd94d861ad491b8c

        SHA512

        e54c4298e1f3e7d947f4f941b7fe459a3bc74b464974f95a8fc4623504e1c4b186a46a323a99239a91349a5d72ac15b5a562a36ef5c72f855823cc9c5c08bbe7

        Download Submit

      • memory/4720-9-0x0000000010000000-0x0000000010012000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4720-10-0x0000000010000000-0x0000000010012000-memory.dmp

        Filesize

        72KB

        Download