Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/01/2024, 18:56

General

  • Target

    65c9171c59824abf19683aad27acca23.exe

  • Size

    79KB

  • MD5

    65c9171c59824abf19683aad27acca23

  • SHA1

    57dada2259d13dc4047bb296ac1552c2c956689e

  • SHA256

    3f1c6b2e6f6a96b7d9d83d2e043c5ec4bfa632f181f396fb4a5bdf04266ff884

  • SHA512

    682d8cf4ee051b027ffcb9754166f544707ca5d8ba37b7b2bd3bc2aa26b95a1ec6998b25600aa7821988da7a587b04dbe575ad125ddd93af3c2620401be92d42

  • SSDEEP

    1536:emGfxYz8xTVffO1Xp30VXE9O53lVZL3tvpS+fs7u1NN/v8Jrw8FkWl:eTpxTVu1Xpk483lHL3tvs+0yLv81Dl

Score
3/10

Malware Config

Signatures

  • Program crash 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65c9171c59824abf19683aad27acca23.exe
    "C:\Users\Admin\AppData\Local\Temp\65c9171c59824abf19683aad27acca23.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4292
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 304
      2⤵
      • Program crash
      PID:4164
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 348
      2⤵
      • Program crash
      PID:2928
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4292 -ip 4292
    1⤵
      PID:2792
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4292 -ip 4292
      1⤵
        PID:3020
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:2792
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3172

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3172-1-0x00000274A5A40000-0x00000274A5A50000-memory.dmp

          Filesize

          64KB

        • memory/3172-17-0x00000274A5B40000-0x00000274A5B50000-memory.dmp

          Filesize

          64KB

        • memory/3172-33-0x00000274ADEB0000-0x00000274ADEB1000-memory.dmp

          Filesize

          4KB

        • memory/3172-35-0x00000274ADEE0000-0x00000274ADEE1000-memory.dmp

          Filesize

          4KB

        • memory/3172-36-0x00000274ADEE0000-0x00000274ADEE1000-memory.dmp

          Filesize

          4KB

        • memory/3172-37-0x00000274ADFF0000-0x00000274ADFF1000-memory.dmp

          Filesize

          4KB

        • memory/4292-0-0x0000000013140000-0x0000000013173000-memory.dmp

          Filesize

          204KB