Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 15:54

General

  • Target

    548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe

  • Size

    3.3MB

  • MD5

    221a71ddde12b86b2a1a2b3a63fd2280

  • SHA1

    6553c87b19df0b79dc8008d157f3bcc5bde011c5

  • SHA256

    548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260

  • SHA512

    09515a5b7a6e7d5e6e4cd7fbbaa4bf70a0d71886ce754254f5146a7f9fb331fe663e9d42a0ef427c56de98b46ad4f0bacd05030429c8fac67ee09d676375170e

  • SSDEEP

    49152:8aBfrnFxwuCpdg037hG1oLqZXCJAQ7eEgZkZBcePYDj9k3VGllCTTfb/JeSlFGqA:8aBnf0395LiAAdPSYlk3PTv3lFGqvY

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe
    "C:\Users\Admin\AppData\Local\Temp\548b5e30b08596bb9415b1e15bb7e3a64b602c40c865f16920854a3ef49b6260.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4308
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1384
      2⤵
      • Program crash
      PID:4652
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4308 -ip 4308
    1⤵
      PID:1600

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\11260565604\LZMA.dll

      Filesize

      67KB

      MD5

      d0f2416807f04c559e6394a0a4c7f1d1

      SHA1

      7df43ffa3716156d282b1e37d12dd1122f0a762c

      SHA256

      0fe6a869cf220769a058f8d281f272ef72669e3587673e52b53f3f9650dcf1fc

      SHA512

      8199c967ad813216f2ef3094a7614c9ccc95d35a817fc685cb7823f36cc97f0279bddd0ec0bb8f07ee2445476aaea35548516841ee9cde53a8be395515457799

    • C:\Users\Admin\AppData\Local\Temp\11260565604\skinconfig\TongJICNZZ.dll

      Filesize

      71KB

      MD5

      40e3899b01616fcaa8f9a6653504dd8b

      SHA1

      d890396f782230078f0e19e8d7d91091c4d0a38b

      SHA256

      0728576d67e8522158549c819de8206dcb886f3ac2997d5a962449bf8b671090

      SHA512

      256a0d95d567708213980fc24a90ada673f9a3bc7692bf30147c42a11e4cf286ccb92de2f360d9056e80e170cbdc06f715676f6f7678743f3e86fa99eff4aa42