Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def.exe
Resource
win10v2004-20220812-en
General
-
Target
d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def.exe
-
Size
325KB
-
MD5
b1b3f53873ad851e6e79e3a000078ba6
-
SHA1
e1594bd0d96c31afa4721b039c008fbdec47a151
-
SHA256
d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def
-
SHA512
39e5aff4bde4c79c40677bf7f05f07dd815e5453e17f3c1da13e1b08aca7e10be95c6d022ac8e6937e512725aa60605bec36765a5a9f4c45f695a203e728a7a6
-
SSDEEP
6144:iRXhcjZLJ3K/TbvWrScxkzdLb2WXcRzq5luu8:LjZNK/PBcitKOkClu
Malware Config
Signatures
-
Detect Amadey credential stealer module 2 IoCs
resource yara_rule behavioral1/files/0x000a000000022e19-148.dat amadey_cred_module behavioral1/files/0x000a000000022e19-149.dat amadey_cred_module -
Blocklisted process makes network request 1 IoCs
flow pid Process 43 3440 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 5024 rovwer.exe 1980 rovwer.exe 5032 rovwer.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation rovwer.exe -
Loads dropped DLL 1 IoCs
pid Process 3440 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
pid pid_target Process procid_target 5012 4056 WerFault.exe 79 3124 1980 WerFault.exe 93 3640 5032 WerFault.exe 97 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4332 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3440 rundll32.exe 3440 rundll32.exe 3440 rundll32.exe 3440 rundll32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4056 wrote to memory of 5024 4056 d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def.exe 80 PID 4056 wrote to memory of 5024 4056 d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def.exe 80 PID 4056 wrote to memory of 5024 4056 d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def.exe 80 PID 5024 wrote to memory of 4332 5024 rovwer.exe 87 PID 5024 wrote to memory of 4332 5024 rovwer.exe 87 PID 5024 wrote to memory of 4332 5024 rovwer.exe 87 PID 5024 wrote to memory of 3440 5024 rovwer.exe 96 PID 5024 wrote to memory of 3440 5024 rovwer.exe 96 PID 5024 wrote to memory of 3440 5024 rovwer.exe 96 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def.exe"C:\Users\Admin\AppData\Local\Temp\d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F3⤵
- Creates scheduled task(s)
PID:4332
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:3440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 8842⤵
- Program crash
PID:5012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4056 -ip 40561⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exeC:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe1⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 4202⤵
- Program crash
PID:3124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1980 -ip 19801⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exeC:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe1⤵
- Executes dropped EXE
PID:5032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 4242⤵
- Program crash
PID:3640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5032 -ip 50321⤵PID:2820
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
325KB
MD5b1b3f53873ad851e6e79e3a000078ba6
SHA1e1594bd0d96c31afa4721b039c008fbdec47a151
SHA256d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def
SHA51239e5aff4bde4c79c40677bf7f05f07dd815e5453e17f3c1da13e1b08aca7e10be95c6d022ac8e6937e512725aa60605bec36765a5a9f4c45f695a203e728a7a6
-
Filesize
325KB
MD5b1b3f53873ad851e6e79e3a000078ba6
SHA1e1594bd0d96c31afa4721b039c008fbdec47a151
SHA256d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def
SHA51239e5aff4bde4c79c40677bf7f05f07dd815e5453e17f3c1da13e1b08aca7e10be95c6d022ac8e6937e512725aa60605bec36765a5a9f4c45f695a203e728a7a6
-
Filesize
325KB
MD5b1b3f53873ad851e6e79e3a000078ba6
SHA1e1594bd0d96c31afa4721b039c008fbdec47a151
SHA256d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def
SHA51239e5aff4bde4c79c40677bf7f05f07dd815e5453e17f3c1da13e1b08aca7e10be95c6d022ac8e6937e512725aa60605bec36765a5a9f4c45f695a203e728a7a6
-
Filesize
325KB
MD5b1b3f53873ad851e6e79e3a000078ba6
SHA1e1594bd0d96c31afa4721b039c008fbdec47a151
SHA256d04b3f83a0693ad28397f673e58bfee3a1b0f8cb7ff95926fbe495ffae4d9def
SHA51239e5aff4bde4c79c40677bf7f05f07dd815e5453e17f3c1da13e1b08aca7e10be95c6d022ac8e6937e512725aa60605bec36765a5a9f4c45f695a203e728a7a6
-
Filesize
126KB
MD5522adad0782501491314a78c7f32006b
SHA1e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA256351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
SHA5125f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7
-
Filesize
126KB
MD5522adad0782501491314a78c7f32006b
SHA1e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA256351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
SHA5125f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7