Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 01:16
Static task
static1
Behavioral task
behavioral1
Sample
ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe
Resource
win10v2004-20220812-en
General
-
Target
ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe
-
Size
489KB
-
MD5
052a2ea735701887331c568bcf2cdf85
-
SHA1
80cbc46a97b0eb58d0359a3761ed4d0741473a99
-
SHA256
ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010
-
SHA512
b8f184f0a80184c8cdcdb240b53e5eec3e7b012990f447d11f0c573d6199aa48a5291e0bdaa9c028b0d0eb986c6358e1f5045256d8df48bfcb6dafac39475690
-
SSDEEP
12288:BWQfhJ7kNO9EoUOPKD3ypHaWIjsDEDsj:B/J7kY9EoUpDipjED
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1576 befadegfdg_P.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4580 1576 WerFault.exe 79 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1576 1196 ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe 79 PID 1196 wrote to memory of 1576 1196 ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe 79 PID 1196 wrote to memory of 1576 1196 ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe"C:\Users\Admin\AppData\Local\Temp\ad89e4f1f4159106e27bcc3d028fec7a16d3f3417e0b9c67f99e63ae59414010.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exeC:\Users\Admin\AppData\Local\Temp\befadegfdg_P.exe 6]3]1]5]5]2]4]3]8]3]8 KU1IPzgvNTUsLxgpUFQ9S0dAOigdJ0hCU1JKUEdGPDopGixDRE5SRUE1LzEwMTMbKkFFQTUtGClNUUo/Uz9RV0Y8Ny83MzQ2HCxLQkpQQlFaUFBIOmBxbGo3LipucHIrPEJLRSpTSksrPU1IK0FIQ04bKkFIRjtIQT46Hyo/LzkqKR0nPi88KCweK0ErOiUrHS4/LzspLhgsPC86LCwbLUxPR0FNPVFeS01HUj47VjUaLE9NSkJRQExcPU9JQDgbLUxPR0FNPVFeSTxLQTpddV0aLERTQF1RT0Q6GClCV0BaQUlBREZGPzofKkNNT1FXP0pJVFJATTsxHSdRQDtLSlRKU1tSSkk1GixVSDgwHCw8UCk3HS5NUExQRkVCV1FCSz5KS0FGRT4/P1JRRzgeK0ZLXEpPS1NESEM5cWpyXRosUUBPU05LQUs/WVJSQE1dQD5RUDUsHS5DREJBVTUuGClGUlo/V0o+RUY7WUJNPk1XTFE9QTVgXmtuYB4rQUdURkZMQD9aR0w6Ki0wKC4wKyk3LyspLyoaLE88TT9IST1JV0NLUk88Skg6bG9tXx0uT0RLQTopMS0qMDYvLC4tHSdBR1FLS0o8QltRQUo9Ny4xKiw1Ky8oLi0kMjkvLDgwLiJNRQ==2⤵
- Executes dropped EXE
PID:1576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 2283⤵
- Program crash
PID:4580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1576 -ip 15761⤵PID:4508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
674KB
MD593c3c1d0d5299bb9cefe9e9181a17070
SHA177a89de10714fd3862276d65ca4cb440628d81a4
SHA256fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7
SHA5129e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3
-
Filesize
674KB
MD593c3c1d0d5299bb9cefe9e9181a17070
SHA177a89de10714fd3862276d65ca4cb440628d81a4
SHA256fbe70131b58335fc221283fe76ee5ebeef38c677ab97a7a775ec1a8beb32aaa7
SHA5129e2871266f95a6f96fd92db2f37141f4a39b095922e1a6f482a73fbaaeb653464f4ff0e445ef3aec95e9b1f2437245ff68fd7bc1c5e5341c572b24a1e4ab0ce3