Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2024, 12:38

General

  • Target

    087f743efe2e8420ab817c555a232e50N.exe

  • Size

    678KB

  • MD5

    087f743efe2e8420ab817c555a232e50

  • SHA1

    a40fc725d117ae3350474615869e1de83f2ea09b

  • SHA256

    940057ae2dd2e1532eebfd06c07b3c50344f27922692479076e267443a9edc17

  • SHA512

    31623e2d8414a1596c23cbd9fd82d6f9e5bf5ab981351de67b1d4c49131420dadee851300953dcb986b4b27f23fd2320afb21b8c805983266a4601833e900002

  • SSDEEP

    12288:7tKe6Zv23YLVFhBsC8iFHs+hsuQXIQVRpVnl3Bg5oiNaYzHvAR8:v6Zv2ivhBVnFvh5Q44+iiUKIa

Score
8/10

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\087f743efe2e8420ab817c555a232e50N.exe
    "C:\Users\Admin\AppData\Local\Temp\087f743efe2e8420ab817c555a232e50N.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:1824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 704
      2⤵
      • Program crash
      PID:3720
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1824 -ip 1824
    1⤵
      PID:1612

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\concp32.exe

      Filesize

      684KB

      MD5

      73a7235ae61399d77dd2168a96f657b0

      SHA1

      14cc5ad83fe9069656e2328df262367a2c699ce8

      SHA256

      3764d2746ceea8958b5cb2fedc779be6def58c3b22c459b008aa82bcf6c508fd

      SHA512

      2fd37fc11e514b4b93a74923a3bd0f3e4fe066ad43968abe7099bf190f88c4bd15b048225c245d4cf53975ad2cb619cd66f8801ab7e4b15f3dfb801ceb25ee2a

    • memory/1824-0-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB

    • memory/1824-7-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB