Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
11/10/2022, 09:50
General
-
Target
98cc680be6ed134bfc3dcd0eeadc04503dcd43b759474707633cb67142069b76.exe
-
Size
489KB
-
MD5
0095fa27d280abf1cff793ca0c498770
-
SHA1
4ab1c61d7b61af298634d14aa10d1c2574447699
-
SHA256
98cc680be6ed134bfc3dcd0eeadc04503dcd43b759474707633cb67142069b76
-
SHA512
c0866ddf988fa9edf03569096e5273ce992320f9ae55660d8a1c292b78ff663dec50568a33d629e52a09f1b5e2665eaa59035b766c5db02b3b42415ea004fa78
-
SSDEEP
6144:ias4DREcMZ5vVCiiKrao9afJu3YYtWGaVoRiS6RxH5AgPauc2vaDjb2v/z2N5Ab:i0FuvVCiisao9Ii3aViKHyv2yDOv63i
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98cc680be6ed134bfc3dcd0eeadc04503dcd43b759474707633cb67142069b76.exe"C:\Users\Admin\AppData\Local\Temp\98cc680be6ed134bfc3dcd0eeadc04503dcd43b759474707633cb67142069b76.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 7363⤵
- Program crash
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4872 -ip 48721⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD5c7801ee067800afa0e1fcdbc29199f53
SHA1251f995464fe59233841770149ed5bdca5bbf821
SHA2564af2e2f413db84072b194d92121380b459d0040de4add842792108e1e92c4fa0
SHA512d8da2ecd9c9f36e87577619edb6e47ae75236768dcf8578326bb698da9387c5a60e3be62c3ec3db222a9339a13e3384ca370529c1537e07f95f503aef63525ed
-
Filesize
151KB
MD5c7801ee067800afa0e1fcdbc29199f53
SHA1251f995464fe59233841770149ed5bdca5bbf821
SHA2564af2e2f413db84072b194d92121380b459d0040de4add842792108e1e92c4fa0
SHA512d8da2ecd9c9f36e87577619edb6e47ae75236768dcf8578326bb698da9387c5a60e3be62c3ec3db222a9339a13e3384ca370529c1537e07f95f503aef63525ed
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
88KB
-
Filesize
88KB