Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2024, 21:11

General

  • Target

    2740-417-0x00000000010C0000-0x0000000001759000-memory.exe

  • Size

    6.6MB

  • MD5

    9e06bb0311a59acc95a7676fb2fee742

  • SHA1

    31b605f547226815fdcf11130065cc353658e114

  • SHA256

    bf081ac73fe25f3878011d9d80f5ecb86b1d74b45714181a17db98ac96915509

  • SHA512

    57a4eae8287850f6ceab1ada077d47f623a09425313dcc264eae0f143f3dbb3ccd372f5c4cc850bbf06a046edeae7b83e62eacf2b36ab860b14b9435b6a3cb4b

  • SSDEEP

    98304:vVsBcY2CyQ+4jLk3xMX8FjR/e7cH+7e1:3qlk3xMX8f/eD6

Malware Config

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2740-417-0x00000000010C0000-0x0000000001759000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\2740-417-0x00000000010C0000-0x0000000001759000-memory.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3240
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 216
      2⤵
      • Program crash
      PID:2380
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3240 -ip 3240
    1⤵
      PID:3472

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3240-0-0x0000000000AC0000-0x0000000001159000-memory.dmp

      Filesize

      6.6MB