Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 15:17

General

  • Target

    e51d2899706d1fc7b2ceb507d49ffd09be932c79e99b0c820eaabe6b39b980c5.exe

  • Size

    949KB

  • MD5

    daa9839e2d085683d0a9f98bf1a485cf

  • SHA1

    62a0fd15177c5b8123a05be32fd1427e8cf2bbb3

  • SHA256

    e51d2899706d1fc7b2ceb507d49ffd09be932c79e99b0c820eaabe6b39b980c5

  • SHA512

    b2a5e944d367711f44d8c8b2035d30950475631b5e62ad9a4e46910fe50fb23a23f18fa1ab6eee11959b9e801b7ab40a8ae148ac015f01ed0c1a1dfd029b858d

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCvqoG0Q+98vd5PG:7JZoQrbTFZY1iaCvs05KjPG

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e51d2899706d1fc7b2ceb507d49ffd09be932c79e99b0c820eaabe6b39b980c5.exe
    "C:\Users\Admin\AppData\Local\Temp\e51d2899706d1fc7b2ceb507d49ffd09be932c79e99b0c820eaabe6b39b980c5.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\e51d2899706d1fc7b2ceb507d49ffd09be932c79e99b0c820eaabe6b39b980c5.exe"
      2⤵
        PID:1152
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 780
        2⤵
        • Program crash
        PID:116
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2216 -ip 2216
      1⤵
        PID:5112

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\autA662.tmp

        Filesize

        263KB

        MD5

        57edaa8382ff8c9d62264ca23d5cd026

        SHA1

        be4cf11fe9f311b817c1410cc1630b3ef6ef3632

        SHA256

        954f3c73beb262a1481b8be0ff0d847086d60652a2380dcd7bc13280c8c37a62

        SHA512

        6086d99a0da4fe2f17139d1767ebc119c671afeb4f22706294744e5e6eaf2b7f9ef910b7a970e1b9ab12ade5bb22875cd0c290456540e603b16865839a2df287

      • memory/2216-7-0x0000000004260000-0x0000000004264000-memory.dmp

        Filesize

        16KB