Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 04:40

General

  • Target

    9ac624ed324400544ae2f1731c822852.exe

  • Size

    178KB

  • MD5

    9ac624ed324400544ae2f1731c822852

  • SHA1

    f968544587a11f8fe0d985f94ce38dfd8df86b5c

  • SHA256

    3c4949f34128e7b2f0368ee83f9646a014a103ee269ec7e135cabf4f173b819e

  • SHA512

    fecb322f1ceba9da460eab627c0f70425742200f4c7e9c976ad8a3d1e9580a747396b3c0e32ef39cb4aad49d9593c45eeabc72d7d37a08fe592a83bc21a423ca

  • SSDEEP

    3072:a2i99xNKkOzyIT2PzfTyRSO5+Ty8AZToEE6ooqiq8EpKP1dwLFurHNnwd6ATekby:P+fAz16PHyf+TyNd1E6dqi4py5wd6ATW

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ac624ed324400544ae2f1731c822852.exe
    "C:\Users\Admin\AppData\Local\Temp\9ac624ed324400544ae2f1731c822852.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:4004
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 1016
      2⤵
      • Program crash
      PID:3764
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4004 -ip 4004
    1⤵
      PID:2480

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\7-zip.chm

      Filesize

      291KB

      MD5

      7af20a455247d111ba7c4b08da90c3f7

      SHA1

      81707b1f7e1b226ca7e6ddd9fc4eabd89b510b88

      SHA256

      02df86b17ac33ba7ec33908bab6b194a55bb15e018e30f19018ce2911a2d8a8f

      SHA512

      1283a689c5c464b6af0b9d7248f75a24ace9b97ec9ad052135d6ec832d259668fe0809f4e7691f67f2be70e0291e0ca9fd947c8259308541bc84a20603e4210f

    • C:\Program Files\Microsoft Office\root\Client\vccorlib140.dll

      Filesize

      5B

      MD5

      b5b682b742431a52ea8b17c72ad9c572

      SHA1

      326320f469235708c59f678c9a7357dca552d306

      SHA256

      30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76

      SHA512

      4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163

    • memory/4004-0-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/4004-3450-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB