Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

1

RootkitRevealer.1.exe

windows7-x64

3

RootkitRevealer.1.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    94s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 11:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RootkitRevealer.1.exe

  • Size

    326KB

  • MD5

    ee738fe9bcdd605821002cec8c7206db

  • SHA1

    d39e8a3fe92adc7d7fbc5293edf8a7b965484a59

  • SHA256

    0b3dfd1d00a0d5da5a88ee2b4734e817ee9c9b13f61eb04dc81660c22051fc27

  • SHA512

    03895a34b4d75e73c18097bd74d2fa515a248b6a9030c78015864120c372a735b39ec74f79e3f572cf5a114fd64f4f022307f354d35003b5ed6922543c20ac04

  • SSDEEP

    3072:9wUjnavdsrBd7o54RJ1Gf1eQWNswtU5bYKx0b4Ilgz9t8NLBs3Rvhp04gbCfl:9f4Qd7BRTGteQ2elrzvxf04gql

Score
3/10
discovery

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\RootkitRevealer.1.exe
    "C:\Users\Admin\AppData\Local\Temp\RootkitRevealer.1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 392 -s 780
      2⤵
      • Program crash
      PID:3568
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 392 -ip 392
    1⤵
      PID:2624

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads