Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe
Resource
win10v2004-20240226-en
General
-
Target
3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe
-
Size
217KB
-
MD5
f0b5654ec744e3a1a2439887a3216704
-
SHA1
4ad99a68e2f40487da7d1c156cc8aa7fa7096bfc
-
SHA256
3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c
-
SHA512
580dd17664ee36fb0640a4a70e46ae8881026183cb044277632c0b70f617254833cd17f2dfcdb03a08a9de608319c8e8c0a752498c2ae902ec8d8adac6a6a9e8
-
SSDEEP
3072:n8cj6C4KCYcqJTyLPwSLTfhrGRi/X78zgD6D8pmrfVg7gRXLboitn/o:8cp46cqJTy7N4i/Ek68KDRXAit/o
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4268 3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe -
Executes dropped EXE 1 IoCs
pid Process 4268 3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe -
Program crash 7 IoCs
pid pid_target Process procid_target 3024 2612 WerFault.exe 87 3900 4268 WerFault.exe 95 2040 4268 WerFault.exe 95 2292 4268 WerFault.exe 95 3120 4268 WerFault.exe 95 1284 4268 WerFault.exe 95 2308 4268 WerFault.exe 95 -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2612 3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4268 3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2612 wrote to memory of 4268 2612 3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe 95 PID 2612 wrote to memory of 4268 2612 3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe 95 PID 2612 wrote to memory of 4268 2612 3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe"C:\Users\Admin\AppData\Local\Temp\3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 3842⤵
- Program crash
PID:3024
-
-
C:\Users\Admin\AppData\Local\Temp\3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exeC:\Users\Admin\AppData\Local\Temp\3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 3523⤵
- Program crash
PID:3900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 7723⤵
- Program crash
PID:2040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 8083⤵
- Program crash
PID:2292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 7803⤵
- Program crash
PID:3120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 7763⤵
- Program crash
PID:1284
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 8003⤵
- Program crash
PID:2308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2612 -ip 26121⤵PID:3576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4268 -ip 42681⤵PID:1880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4268 -ip 42681⤵PID:2320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4268 -ip 42681⤵PID:3020
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4268 -ip 42681⤵PID:2172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4268 -ip 42681⤵PID:4296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4268 -ip 42681⤵PID:3664
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3676fad28ebd270fed59d1de1926204c8c375653ef49801bd90bf9394f41905c.exe
Filesize217KB
MD5eeb0cf0463f8f69f169b3f133ba87e5c
SHA1e11a891212dcb74dc6925479d9307e162ab09a9b
SHA256d2e6d99904b34d76b087636913ab87855db1b79cd42f913f0c47058566023994
SHA512d80a55a5ad082654a476819c2739784dae2a804b34367f5cf57cb4065d74e82e04aa785fef5395342cf842de27d5522ca9d587981f58856bb8fe85963ebb0830