Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2022, 18:38
Static task
static1
Behavioral task
behavioral1
Sample
5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe
Resource
win10v2004-20220812-en
General
-
Target
5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe
-
Size
151KB
-
MD5
2750c694208626e3b366364ef96c9ec3
-
SHA1
109cca902407cfc261585d9fc141b21481b59a3d
-
SHA256
5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96
-
SHA512
337429d7f5a9c1085dca34ba912ffaef54c535f20f97b0aae7c8a9ac24b6b38e68fdd6a74d8b3f9753075541ed878ddb84fdecaa6a5193c3b047f359988bc308
-
SSDEEP
1536:ohJPBg0F66e6dDJ+1nKW3Yc+JwFM3f8P4bnpfzLz/TvacclFI4+D7GPLH5gn4Nm7:v8aGDcxYcHM344bFTLlclFt75g1T3Qev
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\software\WOW6432Node\Microsoft\Windows\CurrentVersion\run 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\K: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\I: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\E: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\Z: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\Y: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\O: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\M: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\G: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\X: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\U: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\R: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\J: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\W: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\V: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\Q: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\P: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\N: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\H: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\F: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\T: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened (read-only) \??\S: 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe File opened for modification C:\Documents and Settings\Admin\Local Settings\Application Data\Microsoft\CD Burning\autorun.inf 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5084 3572 WerFault.exe 82 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3572 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe 3572 5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe"C:\Users\Admin\AppData\Local\Temp\5067ee33f02acd4527a331fb1681399cea3f563e7220ea37992ef40468fe2c96.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 7282⤵
- Program crash
PID:5084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3572 -ip 35721⤵PID:4320