Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    110s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 03:27

General

  • Target

    6116809acfac6247dd333b7ae37eece0N.exe

  • Size

    4.5MB

  • MD5

    6116809acfac6247dd333b7ae37eece0

  • SHA1

    1afd901a233f96840d6b74c433865b946797eddc

  • SHA256

    5e322915c06b8a233e8b37c05be3e2df7ea0a6ed6629b708c4606bdb41beb14e

  • SHA512

    5dbf6e1dfab1d8bffb80568cdb7fa18dbdd6276895b587f6410dd124932dc4f9a965cc8464a673b528e1919109ea288374f2cf38b6904ebde3fb08939e2928ee

  • SSDEEP

    98304:P9ldHPQj6QtL0Vwghfks7UtY3wcfGunyzHCd0sy+IhCxpDh:P9lxYDLRcfks7KYgclVpDh

Score
3/10

Malware Config

Signatures

  • Program crash 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6116809acfac6247dd333b7ae37eece0N.exe
    "C:\Users\Admin\AppData\Local\Temp\6116809acfac6247dd333b7ae37eece0N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2444
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 852
      2⤵
      • Program crash
      PID:4660
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 860
      2⤵
      • Program crash
      PID:1492
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 940
      2⤵
      • Program crash
      PID:4908
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1060
      2⤵
      • Program crash
      PID:1780
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1072
      2⤵
      • Program crash
      PID:2220
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1072
      2⤵
      • Program crash
      PID:4804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1112
      2⤵
      • Program crash
      PID:2688
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1208
      2⤵
      • Program crash
      PID:1504
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 1216
      2⤵
      • Program crash
      PID:1316
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 968
      2⤵
      • Program crash
      PID:3272
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 932
      2⤵
      • Program crash
      PID:1212
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2444 -ip 2444
    1⤵
      PID:3440
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2444 -ip 2444
      1⤵
        PID:3472
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2444 -ip 2444
        1⤵
          PID:2272
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2444 -ip 2444
          1⤵
            PID:3040
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2444 -ip 2444
            1⤵
              PID:2764
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2444 -ip 2444
              1⤵
                PID:3988
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2444 -ip 2444
                1⤵
                  PID:2396
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2444 -ip 2444
                  1⤵
                    PID:3580
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2444 -ip 2444
                    1⤵
                      PID:2056
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2444 -ip 2444
                      1⤵
                        PID:4536
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2444 -ip 2444
                        1⤵
                          PID:2348

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/2444-0-0x0000000000400000-0x0000000000C8C000-memory.dmp

                          Filesize

                          8.5MB

                        • memory/2444-1-0x0000000000400000-0x0000000000C8C000-memory.dmp

                          Filesize

                          8.5MB

                        • memory/2444-2-0x0000000000400000-0x000000000090A000-memory.dmp

                          Filesize

                          5.0MB

                        • memory/2444-3-0x0000000000400000-0x0000000000C8C000-memory.dmp

                          Filesize

                          8.5MB

                        • memory/2444-4-0x0000000000400000-0x0000000000C8C000-memory.dmp

                          Filesize

                          8.5MB

                        • memory/2444-5-0x0000000000400000-0x000000000090A000-memory.dmp

                          Filesize

                          5.0MB

                        • memory/2444-7-0x0000000000400000-0x0000000000C8C000-memory.dmp

                          Filesize

                          8.5MB

                        • memory/2444-6-0x0000000000400000-0x0000000000C8C000-memory.dmp

                          Filesize

                          8.5MB