Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    99s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2022, 19:08

General

  • Target

    1e9abcb2a856feb6d7e09ad9d56c3f9deca0f1958f95c8f80e16164ea8f13a44.exe

  • Size

    157KB

  • MD5

    6c5908c7ead20195fbbba0ce4921abb0

  • SHA1

    5724d8b4d076fad2d838adf3d96f25b76b5253e4

  • SHA256

    1e9abcb2a856feb6d7e09ad9d56c3f9deca0f1958f95c8f80e16164ea8f13a44

  • SHA512

    7eec957abbdce0fb9fd7b4c044d271e562e4779364c2241a1801847d99ca95ea3787e964d7515394e6e6ef22989583e751b8107f36872b6536b66b04baa4e569

  • SSDEEP

    3072:+9rJk8Yf7IFtIRNADzNokhYXR6i9cIBNA3xocgkUqOh/xFGNbF4Rsqfbd6el:+JVO2Iy86iTA3+4UHh/xFGNbF4RsqYel

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1e9abcb2a856feb6d7e09ad9d56c3f9deca0f1958f95c8f80e16164ea8f13a44.exe
    "C:\Users\Admin\AppData\Local\Temp\1e9abcb2a856feb6d7e09ad9d56c3f9deca0f1958f95c8f80e16164ea8f13a44.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1276
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 440
      2⤵
      • Program crash
      PID:816
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    PID:1216
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1276 -ip 1276
    1⤵
      PID:4216

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\k0f47B7j.dll

      Filesize

      100KB

      MD5

      11b73abce7ecb486d4a3d461a63ab527

      SHA1

      39ef68eff913559a228fb1e6019c88bcc88bfac8

      SHA256

      d884dc7a66d31ae5b12cd5ec7f589dd7ff7752d2a75912f32e45442192798309

      SHA512

      16474b9d5f8fa2b17035935a9cc8ab6f39e84235d00811e78309360018f73be5d72169d12bb148f8c82eb85b348829af550a00258157498c1c864e8775f0d2ad

    • \??\c:\program files\k0f47b7j.dll

      Filesize

      100KB

      MD5

      11b73abce7ecb486d4a3d461a63ab527

      SHA1

      39ef68eff913559a228fb1e6019c88bcc88bfac8

      SHA256

      d884dc7a66d31ae5b12cd5ec7f589dd7ff7752d2a75912f32e45442192798309

      SHA512

      16474b9d5f8fa2b17035935a9cc8ab6f39e84235d00811e78309360018f73be5d72169d12bb148f8c82eb85b348829af550a00258157498c1c864e8775f0d2ad

    • memory/1216-136-0x0000000010000000-0x00000000100F7000-memory.dmp

      Filesize

      988KB

    • memory/1216-138-0x0000000010000000-0x00000000100F7000-memory.dmp

      Filesize

      988KB

    • memory/1276-132-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB

    • memory/1276-133-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB

    • memory/1276-139-0x0000000000400000-0x0000000000439000-memory.dmp

      Filesize

      228KB