Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

5

f310dd81d3...3d.exe

windows7-x64

5

f310dd81d3...3d.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    92s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2024, 16:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f310dd81d3c2274dc41b3799af4957d9c84cd614a0917d80f197e84a2bd8753d.exe

  • Size

    1.2MB

  • MD5

    9555aa1cba77c0332e4bcf39ea18a930

  • SHA1

    0679fa343ecb23b46d69f5f4f61002889e7ca0c4

  • SHA256

    a0696896c6b3f84b2d710b79ead538740b4ff55169a18699e96713418d8e3625

  • SHA512

    8729ccb561044645799d4ae4f412a2b096ea8934c0b3b3cbed215385fb8f9437bad6c334e70ddbbde05047ac30781dd3a8eb98f4f540404c8591d94da48d4aa7

  • SSDEEP

    24576:xAHnh+eWsN3skA4RV1Hom2KXcmtcVaeJNFDie74NNdg9tj5:Ih+ZkldoPKsacVtDiY4Nzg9X

Score
5/10

Malware Config

Signatures

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f310dd81d3c2274dc41b3799af4957d9c84cd614a0917d80f197e84a2bd8753d.exe
    "C:\Users\Admin\AppData\Local\Temp\f310dd81d3c2274dc41b3799af4957d9c84cd614a0917d80f197e84a2bd8753d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\f310dd81d3c2274dc41b3799af4957d9c84cd614a0917d80f197e84a2bd8753d.exe"
      2⤵
        PID:2960
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 192
          3⤵
          • Program crash
          PID:888
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2960 -ip 2960
      1⤵
        PID:1280

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\aut41EB.tmp
        Filesize

        267KB

        MD5

        c1c78127a9ec11cc46379a5e6d35e398

        SHA1

        7635a64b44e9a2764024992628449c1b1acf0e62

        SHA256

        6b24876b6737a1347c0e46c948e14d65f69f42fe90d303353f2dc68a28b6b031

        SHA512

        2cdea68d9f8c6be369f3a1f3c028989ac604bd95f4b58422dbfff128d13c2832b5395cc3026b4fb0535df7d95684bc9d14e637b705827f856cc7bbc6b8f479d3

        Download Submit

      • memory/1760-0-0x0000000000B20000-0x0000000000C50000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/1760-13-0x00000000018E0000-0x00000000018E4000-memory.dmp

        Filesize

        16KB

        Download

      • memory/2960-14-0x0000000000530000-0x0000000000573000-memory.dmp

        Filesize

        268KB

        Download