Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/05/2024, 09:10

General

  • Target

    счет для получения платежа.exe

  • Size

    756KB

  • MD5

    7298a7deda422520d5cf1d60b58b1efb

  • SHA1

    5716a49dca3a493aec8aa2fe33f13dbd04c2b803

  • SHA256

    45d799de575c920edd8fcabe0d57341599ba53d80d3f20c82f1f6ba0a190f97f

  • SHA512

    f5b7831e0057d20f93e18a1c2999a37835bcb27912214ca653536e1068ace9d5387c12b4607ee4a9ed1ec9fb778237334f0447ee8acdd2ba2dbe528cfdcef73b

  • SSDEEP

    12288:OIgWET/mr9K+22BEEzFatn4904fne9OUuqlde7tUlLCQPPjBbfg4NGP+uXaV9ohu:gWtb3BEG904feduYlL33jJ3uDhZj8C

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\счет для получения платежа.exe
    "C:\Users\Admin\AppData\Local\Temp\счет для получения платежа.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3828
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 1184
      2⤵
      • Program crash
      PID:2140
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3828 -ip 3828
    1⤵
      PID:516

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3828-0-0x000000007442E000-0x000000007442F000-memory.dmp

      Filesize

      4KB

    • memory/3828-1-0x00000000000A0000-0x0000000000164000-memory.dmp

      Filesize

      784KB

    • memory/3828-2-0x0000000005070000-0x0000000005614000-memory.dmp

      Filesize

      5.6MB

    • memory/3828-3-0x0000000004A00000-0x0000000004A92000-memory.dmp

      Filesize

      584KB

    • memory/3828-4-0x0000000004AE0000-0x0000000004AEA000-memory.dmp

      Filesize

      40KB

    • memory/3828-5-0x0000000074420000-0x0000000074BD0000-memory.dmp

      Filesize

      7.7MB

    • memory/3828-6-0x0000000007310000-0x0000000007332000-memory.dmp

      Filesize

      136KB

    • memory/3828-7-0x0000000004B60000-0x0000000004B6C000-memory.dmp

      Filesize

      48KB

    • memory/3828-8-0x00000000023D0000-0x00000000023E0000-memory.dmp

      Filesize

      64KB

    • memory/3828-9-0x0000000005FD0000-0x0000000006052000-memory.dmp

      Filesize

      520KB

    • memory/3828-10-0x00000000100E0000-0x000000001017C000-memory.dmp

      Filesize

      624KB

    • memory/3828-11-0x0000000074420000-0x0000000074BD0000-memory.dmp

      Filesize

      7.7MB