Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2024, 14:08

General

  • Target

    1c273eec681371420f74c54e3f8f54a847fe46e5cb7acfc890605b07ed8248f3N.exe

  • Size

    4.5MB

  • MD5

    fa1ed3ef9a87933d09205ea2ebfd7fb0

  • SHA1

    051eb4cac8a98c3620b4ca20b878fbe5ab04abbd

  • SHA256

    1c273eec681371420f74c54e3f8f54a847fe46e5cb7acfc890605b07ed8248f3

  • SHA512

    393298f2646df664401af59c87b2b6057eadbf7b3a68183b27a2db079dbbbfb602c7b064cd478fd66c85f809732c185131f5a29112cb1e5a22201d017073ac4d

  • SSDEEP

    98304:5MGf2jqPwejTT9k7lw3lgIJm1PBMckd00ZTz+LX2yC0Di:Ff2jqBTG7lw36r1PSna0ZiXD+

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c273eec681371420f74c54e3f8f54a847fe46e5cb7acfc890605b07ed8248f3N.exe
    "C:\Users\Admin\AppData\Local\Temp\1c273eec681371420f74c54e3f8f54a847fe46e5cb7acfc890605b07ed8248f3N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4056
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 592
      2⤵
      • Program crash
      PID:2392
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4056 -ip 4056
    1⤵
      PID:3944

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4056-0-0x0000000000400000-0x0000000000C35000-memory.dmp

      Filesize

      8.2MB

    • memory/4056-2-0x0000000000FF0000-0x000000000144F000-memory.dmp

      Filesize

      4.4MB

    • memory/4056-1-0x0000000000400000-0x0000000000C35000-memory.dmp

      Filesize

      8.2MB

    • memory/4056-4-0x0000000000401000-0x0000000000861000-memory.dmp

      Filesize

      4.4MB

    • memory/4056-3-0x0000000000D90000-0x0000000000D91000-memory.dmp

      Filesize

      4KB

    • memory/4056-6-0x0000000000FF0000-0x000000000144F000-memory.dmp

      Filesize

      4.4MB

    • memory/4056-5-0x0000000000400000-0x0000000000C35000-memory.dmp

      Filesize

      8.2MB

    • memory/4056-7-0x0000000000401000-0x0000000000861000-memory.dmp

      Filesize

      4.4MB