Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

61a96dfaec...53.exe

windows7-x64

3

61a96dfaec...53.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 16:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    61a96dfaec96bcf0ffac72dbffac887a47b6d9c3cd35413c40ed2bfc45e11453.exe

  • Size

    84KB

  • MD5

    11655adfa31aee2d98c295c570e44720

  • SHA1

    507d28fdb015e35c09324a38b28d4dd019e9de17

  • SHA256

    61a96dfaec96bcf0ffac72dbffac887a47b6d9c3cd35413c40ed2bfc45e11453

  • SHA512

    5fee8aea1122ed0a0265026f04c72071a5fe85c1b208028b9c24d1d484c989997d77e809160167a2c7631357045dc0444a56acb2a53b491537174b7ea8e11cdb

  • SSDEEP

    768:V3ncJu5hBXF2pmiq2V41xNmAFgGyi4XwP13GT9W28z/zMp5xAFiE3s:V3cJu5hBVWq2kN6LXwPVGT9lgA5gs

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Program crash 12 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1272
      • C:\Users\Admin\AppData\Local\Temp\61a96dfaec96bcf0ffac72dbffac887a47b6d9c3cd35413c40ed2bfc45e11453.exe
        "C:\Users\Admin\AppData\Local\Temp\61a96dfaec96bcf0ffac72dbffac887a47b6d9c3cd35413c40ed2bfc45e11453.exe"
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3172
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 1272 -s 7356
        2⤵
        • Program crash
        PID:4868
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 1272 -s 7356
        2⤵
        • Program crash
        PID:4548
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 420 -p 1272 -ip 1272
      1⤵
        PID:3608
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 452 -p 1272 -ip 1272
        1⤵
          PID:1540
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4712
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4712 -s 6112
            2⤵
            • Program crash
            PID:3684
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4712 -s 6112
            2⤵
            • Program crash
            PID:1456
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 552 -p 4712 -ip 4712
          1⤵
            PID:3808
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Enumerates system info in registry
            PID:1156
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 196 -p 4712 -ip 4712
            1⤵
              PID:1256
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
              • Modifies Installed Components in the registry
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:1984
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 1984 -s 6260
                2⤵
                • Program crash
                PID:2884
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 1984 -s 6260
                2⤵
                • Program crash
                PID:4024
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 588 -p 1984 -ip 1984
              1⤵
                PID:4656
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:3464
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -pss -s 580 -p 1984 -ip 1984
                1⤵
                  PID:3744
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:1412
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 1412 -s 5888
                    2⤵
                    • Program crash
                    PID:5076
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -u -p 1412 -s 5964
                    2⤵
                    • Program crash
                    PID:4796
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -pss -s 584 -p 1412 -ip 1412
                  1⤵
                    PID:700
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:3984
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -pss -s 576 -p 1412 -ip 1412
                    1⤵
                      PID:3616
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies Installed Components in the registry
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:720
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 720 -s 5916
                        2⤵
                        • Program crash
                        PID:1132
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 720 -s 5956
                        2⤵
                        • Program crash
                        PID:2844
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Suspicious use of SetWindowsHookEx
                      PID:3468
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 588 -p 720 -ip 720
                      1⤵
                        PID:4064
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 580 -p 720 -ip 720
                        1⤵
                          PID:1084
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies Installed Components in the registry
                          • Enumerates connected drives
                          • Checks SCSI registry key(s)
                          • Modifies registry class
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:2364
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 2364 -s 5940
                            2⤵
                            • Program crash
                            PID:4340
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 2364 -s 5972
                            2⤵
                            • Program crash
                            PID:1536
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 536 -p 2364 -ip 2364
                          1⤵
                            PID:3660
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                            • Suspicious use of SetWindowsHookEx
                            PID:3184
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -pss -s 484 -p 2364 -ip 2364
                            1⤵
                              PID:3644
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                              • Enumerates system info in registry
                              PID:3640
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:4888
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                              • Suspicious use of SetWindowsHookEx
                              PID:4820
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                              • Enumerates system info in registry
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:4064

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F
                              Filesize

                              7KB

                              MD5

                              f739b394d30d392d8eb28922bf5a7e12

                              SHA1

                              78124ad341a0e03ecbb7660011409767e6678fef

                              SHA256

                              4fff638b8a8f8004eb7a6f5d71ba702373ece50bbe85f499d00d09e7c86dc543

                              SHA512

                              48cf40407485d1a22f728220a64dc15e85cf051a44104019efa868cc7fccdefcfea2169eea8fb72be819a8c67892aeee72fd22deca31b8bfbd3f8018e55e215f

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F
                              Filesize

                              232B

                              MD5

                              0bbeefff4f24c150f78cc76c27eea0c8

                              SHA1

                              1aca72caee93a02d98d6423face66349a1f7f441

                              SHA256

                              46674feaff1ebfa47e456c9785b2e487ec42571cab213995d1104009a3e9d804

                              SHA512

                              c2c4f58c6f8d69d28ac557197d5dce8fabb23f5a6efd349370d6dbaca343bf0794152e1b4657527effb797718abca9b3ee9c7043ef591b170041f44a59d963be

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fc930473-291c-4e79-959d-30488056c575}\Apps.ft
                              Filesize

                              38KB

                              MD5

                              7314cfd2fad0b6b527a8fe3e6dd97596

                              SHA1

                              4fc9ef6d5e21c77a92010375a0a5942c3fbf4e4d

                              SHA256

                              98165953997752f649bbf3479ff75a6a1833984950f41f04aad8ca21a86d00c0

                              SHA512

                              0b3bab4cfda37ab597337132f92bdc3d3897ac6810d615b6c62cbed71ba8466039cd4da8763143e6ca16b6553f21a36d42e882c6388d4c1608eddf5fef92301d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{fc930473-291c-4e79-959d-30488056c575}\Apps.index
                              Filesize

                              1.0MB

                              MD5

                              67ba8e7f7f175a2ddba4371f52818d3f

                              SHA1

                              ea789f27b78199b51beeea15076b1bb66c6175a9

                              SHA256

                              b24597daa08491cde184ea8409d441fd6690490b1491f5cd8086d0afef35d12a

                              SHA512

                              ba9befae7761c5d03dc698eff9a7eed83f3a2a6a00080780e4dbe9139fdec800793f205a521857ba26b42b2cec6e0044b121ec1220a30ae6b9a1148920255903

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133135268701632112.txt
                              Filesize

                              73KB

                              MD5

                              83875bc59b4b2ce4ba69690019a7195a

                              SHA1

                              3cb6837c48c4cd4bad8d3aef4b57021839c1eb44

                              SHA256

                              c9fa68d0602128a61a36dc93136b49142fc8d66846a5ee626e4244a96bcd147c

                              SHA512

                              7f7c60abb7999d34cad5dcf437f56954830a92c9ff297a6294d51d32c837f09a9d58d63a110f60c3b31891bd068ac5d5f3511151902690788c94f9b90ebbc3c7

                              Download Submit

                            • memory/4064-144-0x00000235AEFD0000-0x00000235AEFF0000-memory.dmp

                              Filesize

                              128KB

                              Download

                            • memory/4064-151-0x00000235AFCF0000-0x00000235AFD10000-memory.dmp

                              Filesize

                              128KB

                              Download

                            • memory/4064-149-0x00000235AFDB0000-0x00000235AFEB0000-memory.dmp

                              Filesize

                              1024KB

                              Download

                            • memory/4064-142-0x00000235AF2D8000-0x00000235AF2E0000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/4064-245-0x00000235AF200000-0x00000235AF208000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/4064-248-0x00000235C1C50000-0x00000235C1D50000-memory.dmp

                              Filesize

                              1024KB

                              Download

                            • memory/4064-249-0x00000235C1C50000-0x00000235C1D50000-memory.dmp

                              Filesize

                              1024KB

                              Download

                            • memory/4064-276-0x00000235B1007000-0x00000235B100A000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/4064-277-0x00000235B1007000-0x00000235B100A000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/4064-278-0x00000235B1007000-0x00000235B100A000-memory.dmp

                              Filesize

                              12KB

                              Download

                            • memory/4064-279-0x00000235B1007000-0x00000235B100A000-memory.dmp

                              Filesize

                              12KB

                              Download