Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 03:20
Static task
static1
Behavioral task
behavioral1
Sample
cffeeebd8148443e204d9ed2c588f03b41bebb2a2d73f52232e8f3df1dd25be1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cffeeebd8148443e204d9ed2c588f03b41bebb2a2d73f52232e8f3df1dd25be1.exe
Resource
win10v2004-20240508-en
General
-
Target
cffeeebd8148443e204d9ed2c588f03b41bebb2a2d73f52232e8f3df1dd25be1.exe
-
Size
107KB
-
MD5
d639ab2ed87077bd67578993f4fa11b6
-
SHA1
b4eee2e2622fe2ed4aafec2a21514327723a0802
-
SHA256
cffeeebd8148443e204d9ed2c588f03b41bebb2a2d73f52232e8f3df1dd25be1
-
SHA512
31e909985ced25e8355092c8cdc6965bcd1170d6d2ff083567ce2a87c29b2cd78396b4a74ebb6a69a70fbed4fb4a6e14b593b4b143a1804035c9cd52ee75a3f4
-
SSDEEP
3072:REhLjK16CnK4cT6HKBmg0cr22fdmpmtDufp:WjKvcWvcr22fdKp
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1820 2868 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3916 wrote to memory of 2868 3916 regsvr32.exe 83 PID 3916 wrote to memory of 2868 3916 regsvr32.exe 83 PID 3916 wrote to memory of 2868 3916 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\cffeeebd8148443e204d9ed2c588f03b41bebb2a2d73f52232e8f3df1dd25be1.exe1⤵
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\cffeeebd8148443e204d9ed2c588f03b41bebb2a2d73f52232e8f3df1dd25be1.exe2⤵PID:2868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 6003⤵
- Program crash
PID:1820
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2868 -ip 28681⤵PID:4444