Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 20:02

General

  • Target

    2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe

  • Size

    1.1MB

  • MD5

    67c79338802019b7b9d62e72f69b054c

  • SHA1

    daad76f2f6d45d17ace9ba27a6ce7ff86493ccf9

  • SHA256

    2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8

  • SHA512

    ca35522098bd598e7c862e5c9d606acea756071d8cb99fa6cc8d720bbed900857732f08b9409cb3f604e4bffc1ebf6bace9c5a390a42747f2007ffac1ab56b52

  • SSDEEP

    24576:vkeCNtI0aTJg42guvyNczB2SN8URYqxeN9o3KPzdrAjoE7IH1iIH1M:8YL2xy48SdYqxeN9kKxrAjoEUHDH+

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe
    "C:\Users\Admin\AppData\Local\Temp\2b833a097de6e9e44e0aff5ae3a4074405b1492963d7e0fa9434fc425bddafe8.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 612
      2⤵
      • Program crash
      PID:4176
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2608 -ip 2608
    1⤵
      PID:1476

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2608-0-0x0000000002440000-0x0000000002441000-memory.dmp

      Filesize

      4KB

    • memory/2608-1-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-4-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-5-0x0000000002440000-0x0000000002441000-memory.dmp

      Filesize

      4KB

    • memory/2608-6-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-7-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-8-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-9-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-10-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-11-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-12-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-13-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-14-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-15-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-16-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB

    • memory/2608-17-0x0000000000400000-0x0000000000526000-memory.dmp

      Filesize

      1.1MB