Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 00:35

General

  • Target

    2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe

  • Size

    200KB

  • MD5

    a68eb08da5641393687ca0705e423db0

  • SHA1

    48300a4854e2f573b0338281eddc19b777e401f1

  • SHA256

    2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28

  • SHA512

    a33454db305c3a349481f9527aa225ea3358015b5176b32908e968800258e553683304cdf7d6bd7604fa5ffc3e612fc4b600ccd3bd47002d3b09607f6a8c98e8

  • SSDEEP

    6144:XdjUIplSG5LrSvcwc7yeLGzSCsddc8G1B7u:hFSv7eLsBAdTG1BC

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe
    "C:\Users\Admin\AppData\Local\Temp\2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 396
      2⤵
      • Program crash
      PID:3952
    • C:\Users\Admin\AppData\Local\Temp\2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe
      C:\Users\Admin\AppData\Local\Temp\2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2140
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 364
        3⤵
        • Program crash
        PID:2700
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3732 -ip 3732
    1⤵
      PID:2360
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2140 -ip 2140
      1⤵
        PID:3892

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\2314accfaf747ef6c3063ee68ed2f91539faea3bb9a6bc1f97bada3f655feb28.exe

        Filesize

        200KB

        MD5

        109e7784a6716e20060b58b7eb5b6355

        SHA1

        e30558121d7f701e1cb4630df490452450fe9368

        SHA256

        3390755ddb3e23c365278e4b04033b108fd7ddbac49874d2cbb32cc3c7c9d1f3

        SHA512

        a5e05f000563550843c17217ea69fb4077cd6db8d192dfab49b28b6643eb4132cf213f91f9fa6de6c4c92998c61bdb504a4cae5fecd4108949e2d8ea901fbb77

      • memory/2140-7-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/2140-8-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

      • memory/2140-13-0x00000000014E0000-0x000000000151F000-memory.dmp

        Filesize

        252KB

      • memory/3732-0-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/3732-6-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB