Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 13:51
Static task
static1
Behavioral task
behavioral1
Sample
ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b.exe
Resource
win10v2004-20220812-en
General
-
Target
ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b.exe
-
Size
317KB
-
MD5
083b318840c63ee177519f1b7d45f1af
-
SHA1
e512fa09d72a2027e7eb5b29989aba6b0d739378
-
SHA256
ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b
-
SHA512
83e8d9e34102831a294e9d259faf405aed442c6a6b47ecbdd6f17213b4ac41288300e5ead32400a14af4d19ea9cf37fa3791933c083046b163163e5aba41e34c
-
SSDEEP
6144:/Rg2HxuuQagkTj9hBhf+q/R+eDDyVMKOKhWKO9POgVxiarcEqh9D1m:5BHx19g2jfBNWrVtOIWHPR+Eco
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1928 bEjOgGo15301.exe -
resource yara_rule behavioral2/memory/4644-132-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/4644-134-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/4644-135-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/1928-142-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/4644-143-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/1928-144-0x0000000000400000-0x00000000004B4000-memory.dmp upx behavioral2/memory/4644-145-0x0000000000400000-0x00000000004B4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bEjOgGo15301 = "C:\\ProgramData\\bEjOgGo15301\\bEjOgGo15301.exe" bEjOgGo15301.exe -
Program crash 26 IoCs
pid pid_target Process procid_target 1060 4644 WerFault.exe 78 5116 1928 WerFault.exe 79 1452 4644 WerFault.exe 78 1608 1928 WerFault.exe 79 116 1928 WerFault.exe 79 3792 4644 WerFault.exe 78 376 4644 WerFault.exe 78 4504 1928 WerFault.exe 79 3628 4644 WerFault.exe 78 2952 4644 WerFault.exe 78 4312 1928 WerFault.exe 79 2136 1928 WerFault.exe 79 4620 4644 WerFault.exe 78 4044 1928 WerFault.exe 79 3868 1928 WerFault.exe 79 740 1928 WerFault.exe 79 3888 1928 WerFault.exe 79 2220 1928 WerFault.exe 79 1140 1928 WerFault.exe 79 3312 1928 WerFault.exe 79 540 1928 WerFault.exe 79 3160 1928 WerFault.exe 79 4480 1928 WerFault.exe 79 388 4644 WerFault.exe 78 1540 4644 WerFault.exe 78 1272 1928 WerFault.exe 79 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4644 ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b.exe Token: SeDebugPrivilege 1928 bEjOgGo15301.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1928 bEjOgGo15301.exe 1928 bEjOgGo15301.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1928 bEjOgGo15301.exe 1928 bEjOgGo15301.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1928 bEjOgGo15301.exe 1928 bEjOgGo15301.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4644 wrote to memory of 1928 4644 ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b.exe 79 PID 4644 wrote to memory of 1928 4644 ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b.exe 79 PID 4644 wrote to memory of 1928 4644 ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b.exe"C:\Users\Admin\AppData\Local\Temp\ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\ProgramData\bEjOgGo15301\bEjOgGo15301.exe"C:\ProgramData\bEjOgGo15301\bEjOgGo15301.exe" "C:\Users\Admin\AppData\Local\Temp\ae3bb4d1a67520467269660489264d9424e0b24ed334aeacc23d1bd9e53fdc1b.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1928 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 7643⤵
- Program crash
PID:5116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 7723⤵
- Program crash
PID:1608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 7723⤵
- Program crash
PID:116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 7963⤵
- Program crash
PID:4504
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 9243⤵
- Program crash
PID:4312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 9963⤵
- Program crash
PID:2136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 10523⤵
- Program crash
PID:4044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 12203⤵
- Program crash
PID:3868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 14123⤵
- Program crash
PID:740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 16203⤵
- Program crash
PID:3888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 9483⤵
- Program crash
PID:2220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 6403⤵
- Program crash
PID:1140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 16963⤵
- Program crash
PID:3312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 18843⤵
- Program crash
PID:540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 18923⤵
- Program crash
PID:3160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 19723⤵
- Program crash
PID:4480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 19683⤵
- Program crash
PID:1272
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 6202⤵
- Program crash
PID:1060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 7882⤵
- Program crash
PID:1452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 7962⤵
- Program crash
PID:3792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 7882⤵
- Program crash
PID:376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 8442⤵
- Program crash
PID:3628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 9642⤵
- Program crash
PID:2952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 10402⤵
- Program crash
PID:4620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 6402⤵
- Program crash
PID:388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 1602⤵
- Program crash
PID:1540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4644 -ip 46441⤵PID:3084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1928 -ip 19281⤵PID:1948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4644 -ip 46441⤵PID:1524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1928 -ip 19281⤵PID:2008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1928 -ip 19281⤵PID:4304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4644 -ip 46441⤵PID:4816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4644 -ip 46441⤵PID:4048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1928 -ip 19281⤵PID:1672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4644 -ip 46441⤵PID:4496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1928 -ip 19281⤵PID:3120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4644 -ip 46441⤵PID:3468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1928 -ip 19281⤵PID:488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4644 -ip 46441⤵PID:2968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1928 -ip 19281⤵PID:2416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 1928 -ip 19281⤵PID:4904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1928 -ip 19281⤵PID:4468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 1928 -ip 19281⤵PID:3348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 1928 -ip 19281⤵PID:4916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 1928 -ip 19281⤵PID:4240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1928 -ip 19281⤵PID:4388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 1928 -ip 19281⤵PID:4680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 1928 -ip 19281⤵PID:3692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 1928 -ip 19281⤵PID:2824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4644 -ip 46441⤵PID:1608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4644 -ip 46441⤵PID:2660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1928 -ip 19281⤵PID:4068
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
317KB
MD56b87f993ae1ba56bed8791e06797ac62
SHA1d064758a320d727ee93aa58164a25d89a93b5961
SHA256db7b73b8e35351a342f620f7594de209adc4a71f35c3d0177c953dbf181ece07
SHA512138cfee8d2b8c87861dad4aaa5ad737fc43e82bbb6dd130465436852e669155467c829fe9cc62898d1584703c0385892915ce803f08d429b9ff415823f3244b9
-
Filesize
317KB
MD56b87f993ae1ba56bed8791e06797ac62
SHA1d064758a320d727ee93aa58164a25d89a93b5961
SHA256db7b73b8e35351a342f620f7594de209adc4a71f35c3d0177c953dbf181ece07
SHA512138cfee8d2b8c87861dad4aaa5ad737fc43e82bbb6dd130465436852e669155467c829fe9cc62898d1584703c0385892915ce803f08d429b9ff415823f3244b9