Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 02:26

General

  • Target

    GetColor/GetColor.exe

  • Size

    375KB

  • MD5

    4891cd25883a960412809d68a9e08aa8

  • SHA1

    d9d6e57fe125fbc58047fd7c7d509fb7c0948392

  • SHA256

    4e5a3c8557f9eeaa883ee52dab3251047a0a28aef68b2fbbd8278e29e63f67f4

  • SHA512

    0b6930f81e1b0543b355c0cb83c4a25306406400af6fb83b9b88e4e7434294e65d2ce554e199541811900fa6b5cee56618e382c3110c283cdb9497d5b7002f1f

  • SSDEEP

    6144:R3eWxZR+Qad3JHXoZMRepmH8sOpk6InMglEOaGDQoyazscUdEschy4a:R3eWTwP3oZ1pbT5gj3DQoyazsf4y4a

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\GetColor\GetColor.exe
    "C:\Users\Admin\AppData\Local\Temp\GetColor\GetColor.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 268
      2⤵
      • Program crash
      PID:3584
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2392 -ip 2392
    1⤵
      PID:2044

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2392-1-0x00000000772B2000-0x00000000772B3000-memory.dmp

      Filesize

      4KB

    • memory/2392-0-0x0000000000590000-0x0000000000602000-memory.dmp

      Filesize

      456KB

    • memory/2392-2-0x0000000000500000-0x0000000000501000-memory.dmp

      Filesize

      4KB

    • memory/2392-3-0x0000000000590000-0x0000000000602000-memory.dmp

      Filesize

      456KB