Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3e3356f612...aa.exe

windows7-x64

8

3e3356f612...aa.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 20:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe

  • Size

    422KB

  • MD5

    839d8d19bb9030afe8c8db9f621eaf20

  • SHA1

    b984f9a2a577d215629fdf2f0e5bd27fee51e7f9

  • SHA256

    3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa

  • SHA512

    5e299c5860fe756609f6cf2135f4c49a01171b83a1695e95a515d5ba7a4a312ebe7479129dfea17139beeeaffc641ad6f5dc6891338c295ed76210dbc154080c

  • SSDEEP

    6144:tmwa1PEq/Dz4AbgAlrUWpWcgQZNddAwXajgFEn8Awpdm73KPCOK6Zni:tm31PlMaJrDPgEddtygcDWCP6Zni

Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe
    "C:\Users\Admin\AppData\Local\Temp\3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 904
      2⤵
      • Program crash
      PID:308
    • C:\ProgramData\cB08999LlCgD08999\cB08999LlCgD08999.exe
      "C:\ProgramData\cB08999LlCgD08999\cB08999LlCgD08999.exe" "C:\Users\Admin\AppData\Local\Temp\3e3356f612da68a90db523a1432c4e89654d630e37fccec7cd641498344471aa.exe"
      2⤵
      • Modifies security service
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2736
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 900
        3⤵
        • Program crash
        PID:1316
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2564 -ip 2564
    1⤵
      PID:1752
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2736 -ip 2736
      1⤵
        PID:2392
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:4080
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:3228
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:4308
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:1688
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:4128
      • C:\Windows\system32\sihost.exe
        sihost.exe
        1⤵
        • Suspicious use of FindShellTrayWindow
        PID:1368
      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
        1⤵
          PID:720

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\cB08999LlCgD08999\cB08999LlCgD08999.exe
          Filesize

          422KB

          MD5

          5d90ca2fea6f1a8446434628daca930e

          SHA1

          319678d6d2b5f907fc296cead16809eaca13ae60

          SHA256

          26a0f45f542f44dd2706d0fb8830356b2a4da07ae42eb7b44b74f6f6e7c271f9

          SHA512

          dc13d30aa4edc27f6695b9e206f7d9edeefc0796f1139f76f8597b1324c0fb5513aab85a9947c5c8811faddb59a2fd11caedb22e5ee62eba2be3eb3b2cc4c866

          Download Submit

        • C:\ProgramData\cB08999LlCgD08999\cB08999LlCgD08999.exe
          Filesize

          422KB

          MD5

          5d90ca2fea6f1a8446434628daca930e

          SHA1

          319678d6d2b5f907fc296cead16809eaca13ae60

          SHA256

          26a0f45f542f44dd2706d0fb8830356b2a4da07ae42eb7b44b74f6f6e7c271f9

          SHA512

          dc13d30aa4edc27f6695b9e206f7d9edeefc0796f1139f76f8597b1324c0fb5513aab85a9947c5c8811faddb59a2fd11caedb22e5ee62eba2be3eb3b2cc4c866

          Download Submit

        • memory/2564-132-0x0000000002230000-0x0000000002233000-memory.dmp

          Filesize

          12KB

          Download

        • memory/2564-133-0x0000000000400000-0x00000000004D2000-memory.dmp

          Filesize

          840KB

          Download

        • memory/2564-137-0x0000000000400000-0x00000000004D2000-memory.dmp

          Filesize

          840KB

          Download

        • memory/2736-138-0x0000000000400000-0x00000000004D2000-memory.dmp

          Filesize

          840KB

          Download