Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 01:58
Behavioral task
behavioral1
Sample
4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe
-
Size
41KB
-
MD5
04bdd463c9dd9646d7e6030ce8a712fc
-
SHA1
4df3d2af622f794fd4b22468963da7c431fd4779
-
SHA256
4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7
-
SHA512
7abefdea71250599cd4531eb2bbeb846f70d512d4a1cf2bd9fe9b405727bf8a8c377abd7279300c7d883ef0f80dc62acb5758edfcd167ffda9514fb6ed4d52ed
-
SSDEEP
768:Ug3igMMqO22C8Sby7ijZBkvFBvhoIeshR1Q8GkRMwU+LXet26DpIyd+IdvMlCJ:QgMMqj28lAFfoIPhRu3kZU+LXl6DpFdR
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\protocol 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe File opened for modification C:\Windows\System32\drivers\etc\protocol lsass -
Executes dropped EXE 1 IoCs
pid Process 1268 lsass -
resource yara_rule behavioral2/memory/4372-132-0x0000000000400000-0x0000000000481000-memory.dmp upx behavioral2/files/0x0002000000021b42-134.dat upx behavioral2/files/0x0002000000021b42-135.dat upx behavioral2/memory/1268-136-0x0000000000400000-0x0000000000481000-memory.dmp upx behavioral2/memory/4372-137-0x0000000000400000-0x0000000000481000-memory.dmp upx behavioral2/memory/1268-138-0x0000000000400000-0x0000000000481000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 3412 4372 WerFault.exe 79 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 1268 lsass 1268 lsass 1268 lsass 1268 lsass 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass 1268 lsass -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4372 wrote to memory of 1268 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 81 PID 4372 wrote to memory of 1268 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 81 PID 4372 wrote to memory of 1268 4372 4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe"C:\Users\Admin\AppData\Local\Temp\4c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\ProgramData\lsassC:\ProgramData\lsass2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 6122⤵
- Program crash
PID:3412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4372 -ip 43721⤵PID:2984
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD504bdd463c9dd9646d7e6030ce8a712fc
SHA14df3d2af622f794fd4b22468963da7c431fd4779
SHA2564c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7
SHA5127abefdea71250599cd4531eb2bbeb846f70d512d4a1cf2bd9fe9b405727bf8a8c377abd7279300c7d883ef0f80dc62acb5758edfcd167ffda9514fb6ed4d52ed
-
Filesize
41KB
MD504bdd463c9dd9646d7e6030ce8a712fc
SHA14df3d2af622f794fd4b22468963da7c431fd4779
SHA2564c7be60afb796665e69a3d58405f2728f87d6c86a9584205b7edb55057bfa4a7
SHA5127abefdea71250599cd4531eb2bbeb846f70d512d4a1cf2bd9fe9b405727bf8a8c377abd7279300c7d883ef0f80dc62acb5758edfcd167ffda9514fb6ed4d52ed