Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/10/2022, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe
Resource
win10v2004-20220812-en
General
-
Target
63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe
-
Size
682KB
-
MD5
34ec06a3c8c4d7852fab882ccc255588
-
SHA1
9f5e820cbed513a9c876e64e5e7d3e8e7246ddcc
-
SHA256
63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224
-
SHA512
632c76db542726ba64934575362b04906ed88aec7b42759e3e53c8cc12a32129de4d68efbc0720ee2ee341aa7a4ce2a24c2748bee385d61061854283c168f320
-
SSDEEP
6144:kXvfBpagCbR06yyP2Rxn+/5I9YcfUrfxLBWgeTBOO:4fsR0lyP0n+m9Mr3eTz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1348 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe -
Loads dropped DLL 4 IoCs
pid Process 880 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe 272 WerFault.exe 272 WerFault.exe 272 WerFault.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\NYJFiEA.dll 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe File created C:\Windows\peuLLWo.dll 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe File created C:\Windows\hmnEMQO\pJBDUJP.dll 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe File opened for modification C:\Windows\hmnEMQO\pJBDUJP.dll 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 272 1348 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1348 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe 1348 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe 1348 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 880 wrote to memory of 1348 880 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe 27 PID 880 wrote to memory of 1348 880 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe 27 PID 880 wrote to memory of 1348 880 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe 27 PID 880 wrote to memory of 1348 880 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe 27 PID 1348 wrote to memory of 272 1348 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe 28 PID 1348 wrote to memory of 272 1348 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe 28 PID 1348 wrote to memory of 272 1348 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe 28 PID 1348 wrote to memory of 272 1348 63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe"C:\Users\Admin\AppData\Local\Temp\63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9fb85d6b44d6dfd224.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\fmBAqf\63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe"C:\Users\Admin\AppData\Local\Temp\fmBAqf\63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 5563⤵
- Loads dropped DLL
- Program crash
PID:272
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fmBAqf\63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe
Filesize687KB
MD576f0bc7ab0e4972e931d3abee1fe91ac
SHA1f98ecb602e0b895fcaeed9eb7e6ff9a85b65ec8a
SHA256618a4af014d50c512767287f13ec91e8cfbb6e8838fd6443cf6ced838b0e2764
SHA512ab3256f875134b30c11eb526b888219c4f8253188884f62a028116c43b8b15f58356687f2932bfd4fdbdfba1cbd5b1510a3d433c1dfaed8c44cd6fa68c799e8e
-
C:\Users\Admin\AppData\Local\Temp\fmBAqf\63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe
Filesize687KB
MD576f0bc7ab0e4972e931d3abee1fe91ac
SHA1f98ecb602e0b895fcaeed9eb7e6ff9a85b65ec8a
SHA256618a4af014d50c512767287f13ec91e8cfbb6e8838fd6443cf6ced838b0e2764
SHA512ab3256f875134b30c11eb526b888219c4f8253188884f62a028116c43b8b15f58356687f2932bfd4fdbdfba1cbd5b1510a3d433c1dfaed8c44cd6fa68c799e8e
-
\Users\Admin\AppData\Local\Temp\fmBAqf\63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe
Filesize687KB
MD576f0bc7ab0e4972e931d3abee1fe91ac
SHA1f98ecb602e0b895fcaeed9eb7e6ff9a85b65ec8a
SHA256618a4af014d50c512767287f13ec91e8cfbb6e8838fd6443cf6ced838b0e2764
SHA512ab3256f875134b30c11eb526b888219c4f8253188884f62a028116c43b8b15f58356687f2932bfd4fdbdfba1cbd5b1510a3d433c1dfaed8c44cd6fa68c799e8e
-
\Users\Admin\AppData\Local\Temp\fmBAqf\63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe
Filesize687KB
MD576f0bc7ab0e4972e931d3abee1fe91ac
SHA1f98ecb602e0b895fcaeed9eb7e6ff9a85b65ec8a
SHA256618a4af014d50c512767287f13ec91e8cfbb6e8838fd6443cf6ced838b0e2764
SHA512ab3256f875134b30c11eb526b888219c4f8253188884f62a028116c43b8b15f58356687f2932bfd4fdbdfba1cbd5b1510a3d433c1dfaed8c44cd6fa68c799e8e
-
\Users\Admin\AppData\Local\Temp\fmBAqf\63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe
Filesize687KB
MD576f0bc7ab0e4972e931d3abee1fe91ac
SHA1f98ecb602e0b895fcaeed9eb7e6ff9a85b65ec8a
SHA256618a4af014d50c512767287f13ec91e8cfbb6e8838fd6443cf6ced838b0e2764
SHA512ab3256f875134b30c11eb526b888219c4f8253188884f62a028116c43b8b15f58356687f2932bfd4fdbdfba1cbd5b1510a3d433c1dfaed8c44cd6fa68c799e8e
-
\Users\Admin\AppData\Local\Temp\fmBAqf\63f92f0428e5667282ca66bd24b5c693694c01a66ddf0c9b85d6b44d6dfd224.exe
Filesize687KB
MD576f0bc7ab0e4972e931d3abee1fe91ac
SHA1f98ecb602e0b895fcaeed9eb7e6ff9a85b65ec8a
SHA256618a4af014d50c512767287f13ec91e8cfbb6e8838fd6443cf6ced838b0e2764
SHA512ab3256f875134b30c11eb526b888219c4f8253188884f62a028116c43b8b15f58356687f2932bfd4fdbdfba1cbd5b1510a3d433c1dfaed8c44cd6fa68c799e8e