Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    4294208s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    21/03/2022, 09:00 UTC

General

  • Target

    9394c417afa9c6615a4aa929b062f420.exe

  • Size

    210KB

  • MD5

    9394c417afa9c6615a4aa929b062f420

  • SHA1

    b63ec408e1d573ad34b0acca7821db58b9c9135d

  • SHA256

    ebbf3b5a2fea9d1313ec35ce127db7dd86a7b6c55c241fcf3d7e2f7b167a7100

  • SHA512

    9129389dcda5b669e8e3e13424d2fe9fa851b4daa1dfb68e5da1e57591d88ff52e9c534716bc337ef9b838d73faa71af3763ff11e000788ec21effe7b883b76b

Malware Config

Signatures

  • VKeylogger

    A keylogger first seen in Nov 2020.

  • VKeylogger Payload 19 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Program crash 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
    "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
      "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1584
      • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
        "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:432
        • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
          "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1472
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 36
            5⤵
            • Program crash
            PID:980
        • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
          "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1148
          • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
            "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1560
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 36
              6⤵
              • Program crash
              PID:1116
          • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
            "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
            5⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1844
            • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
              "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1576
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 36
                7⤵
                • Program crash
                PID:1736
            • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
              "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
              6⤵
                PID:1048
                • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                  "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                  7⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1620
                  • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                    "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                    8⤵
                      PID:1800
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 36
                        9⤵
                        • Program crash
                        PID:1672
                    • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                      "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                      8⤵
                        PID:1240
                        • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                          "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                          9⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1376
                          • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                            "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                            10⤵
                              PID:1516
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 36
                                11⤵
                                • Program crash
                                PID:1732
                            • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                              "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                              10⤵
                                PID:1728
                                • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                                  "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                                  11⤵
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:892
                                  • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                                    "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                                    12⤵
                                      PID:1968
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 36
                                        13⤵
                                        • Program crash
                                        PID:1840
                                    • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                                      "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                                      12⤵
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1304
                                      • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                                        13⤵
                                          PID:996
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 996 -s 36
                                            14⤵
                                            • Program crash
                                            PID:1308
                                        • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                                          "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                                          13⤵
                                          • Suspicious use of SetThreadContext
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1568
                                          • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                                            "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                                            14⤵
                                              PID:1468
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1468 -s 36
                                                15⤵
                                                • Program crash
                                                PID:1992
                                            • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                                              "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                                              14⤵
                                                PID:1684
                                                • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                                                  15⤵
                                                  • Suspicious use of SetThreadContext
                                                  PID:1608
                                                  • C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\9394c417afa9c6615a4aa929b062f420.exe"
                                                    16⤵
                                                      PID:768
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 36
                                                        17⤵
                                                        • Program crash
                                                        PID:1520

                      Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/432-74-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/892-160-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1048-107-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1048-108-0x0000000077300000-0x0000000077480000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/1148-89-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1148-90-0x0000000077300000-0x0000000077480000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/1240-127-0x0000000077300000-0x0000000077480000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/1240-126-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1280-55-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1280-73-0x0000000077300000-0x0000000077480000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/1304-175-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1376-142-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1472-64-0x0000000000400000-0x000000000040F000-memory.dmp

                        Filesize

                        60KB

                      • memory/1472-66-0x0000000000400000-0x000000000040F000-memory.dmp

                        Filesize

                        60KB

                      • memory/1472-62-0x0000000000400000-0x000000000040F000-memory.dmp

                        Filesize

                        60KB

                      • memory/1472-60-0x0000000000400000-0x000000000040F000-memory.dmp

                        Filesize

                        60KB

                      • memory/1472-70-0x0000000000400000-0x000000000040F000-memory.dmp

                        Filesize

                        60KB

                      • memory/1472-68-0x0000000000400000-0x000000000040F000-memory.dmp

                        Filesize

                        60KB

                      • memory/1472-72-0x0000000000400000-0x000000000040F000-memory.dmp

                        Filesize

                        60KB

                      • memory/1568-190-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1584-58-0x0000000077300000-0x0000000077480000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/1584-57-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1608-208-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1620-124-0x0000000077300000-0x0000000077480000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/1620-123-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1684-192-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1684-195-0x0000000077300000-0x0000000077480000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/1728-145-0x0000000077300000-0x0000000077480000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/1728-144-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      • memory/1844-105-0x0000000000230000-0x0000000000267000-memory.dmp

                        Filesize

                        220KB

                      We care about your privacy.

                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.