Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
0344c96caa8e385e0376de92ac9112330593fa1075ddca40acfbd7917b3587ec.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0344c96caa8e385e0376de92ac9112330593fa1075ddca40acfbd7917b3587ec.exe
Resource
win10v2004-20231215-en
General
-
Target
0344c96caa8e385e0376de92ac9112330593fa1075ddca40acfbd7917b3587ec.exe
-
Size
168KB
-
MD5
266b7a0b55a3cf48547107cbf51c023b
-
SHA1
224f284c1ff4786813cd797e4b78cc93811a36df
-
SHA256
0344c96caa8e385e0376de92ac9112330593fa1075ddca40acfbd7917b3587ec
-
SHA512
569db070086e09478fe77bb5d72b757ac50ca7d4343336b6191a03d553623ec8b6230db307374f22f2eb99025de62f61f2e62f0ef5b0799a14678ae8cd215207
-
SSDEEP
3072:5arsteHd+LeDhoQ3nICTTuJZqOFK+fxJw12DMbwHTG:5BeHdGeDhoQ3nICTTWZqOFK+fxJyGhT
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3980 3044 WerFault.exe 83 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3044 0344c96caa8e385e0376de92ac9112330593fa1075ddca40acfbd7917b3587ec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0344c96caa8e385e0376de92ac9112330593fa1075ddca40acfbd7917b3587ec.exe"C:\Users\Admin\AppData\Local\Temp\0344c96caa8e385e0376de92ac9112330593fa1075ddca40acfbd7917b3587ec.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:3044 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 4642⤵
- Program crash
PID:3980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3044 -ip 30441⤵PID:4596