Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 08:06
Behavioral task
behavioral1
Sample
9a9c01a6901d550fc10ab33b591162e40a354f45733d4f37d69eca6ae2f57e10.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9a9c01a6901d550fc10ab33b591162e40a354f45733d4f37d69eca6ae2f57e10.exe
Resource
win10v2004-20220812-en
General
-
Target
9a9c01a6901d550fc10ab33b591162e40a354f45733d4f37d69eca6ae2f57e10.exe
-
Size
99KB
-
MD5
3133c5923c2b5cf0154894b78563214a
-
SHA1
5646405925089e7feea2d5277814bd7d18403914
-
SHA256
9a9c01a6901d550fc10ab33b591162e40a354f45733d4f37d69eca6ae2f57e10
-
SHA512
5352da94b30ff32bc9dbeb5c674d2fd6c95b0ee9effb4ce39e0fdfaf12626e7ccb1300c1ef8e9a87c7a8346747656f2244b0cf5360c12683b0411ac78092818f
-
SSDEEP
3072:Qwi089AvUB1LZPE1AAQvCTjE/j15AY41C:c0wB1LlyVb+15AYF
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1152-132-0x0000000000400000-0x0000000000440000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{12D28CD2-E460-4068-9FB8-BB9FB1D37C67}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{ACA7DDF1-1A3D-436D-AAE6-9D226846BE1F}.catalogItem svchost.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3080 1152 WerFault.exe 74 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1152 9a9c01a6901d550fc10ab33b591162e40a354f45733d4f37d69eca6ae2f57e10.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a9c01a6901d550fc10ab33b591162e40a354f45733d4f37d69eca6ae2f57e10.exe"C:\Users\Admin\AppData\Local\Temp\9a9c01a6901d550fc10ab33b591162e40a354f45733d4f37d69eca6ae2f57e10.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 6482⤵
- Program crash
PID:3080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1152 -ip 11521⤵PID:3232
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4260