Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

8b44c397aa...d1.exe

windows7-x64

6

8b44c397aa...d1.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 21:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8b44c397aa90da26edcb396ebfabf215765797f0c08beb3f8c67fdd340ed7ad1.exe

  • Size

    837KB

  • MD5

    706a0a7e0a310d4cd9892da6eac94bd5

  • SHA1

    ddfd97c15890011473a9f8f8a539f4abdd7097ff

  • SHA256

    8b44c397aa90da26edcb396ebfabf215765797f0c08beb3f8c67fdd340ed7ad1

  • SHA512

    e1912d9bb4af2795638a1c01bb2508ad970449c35daa4c621b2c4f7797a4f44d82a720e66c3258c2224c8ba51ad59bc5ea2fdafe8eb450e6106601f1e7a9a80a

  • SSDEEP

    12288:myisyhiNFfWcVFeYPPtuIk5BMqQy7wo/VrOH74xkcwpP78WwOXfwcntnicI:pisj3PlXtuXsqFwa9kcwpwW77ET

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 58 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b44c397aa90da26edcb396ebfabf215765797f0c08beb3f8c67fdd340ed7ad1.exe
    "C:\Users\Admin\AppData\Local\Temp\8b44c397aa90da26edcb396ebfabf215765797f0c08beb3f8c67fdd340ed7ad1.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 808
      2⤵
      • Program crash
      PID:4884
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 828
      2⤵
      • Program crash
      PID:3492
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1260
      2⤵
      • Program crash
      PID:3124
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1312
      2⤵
      • Program crash
      PID:1476
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1308
      2⤵
      • Program crash
      PID:2756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1324
      2⤵
      • Program crash
      PID:112
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1408
      2⤵
      • Program crash
      PID:2208
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1452
      2⤵
      • Program crash
      PID:3176
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1488
      2⤵
      • Program crash
      PID:3684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 1820
      2⤵
      • Program crash
      PID:4792
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2608 -ip 2608
    1⤵
      PID:3748
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2608 -ip 2608
      1⤵
        PID:1556
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2608 -ip 2608
        1⤵
          PID:4172
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2608 -ip 2608
          1⤵
            PID:4076
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2608 -ip 2608
            1⤵
              PID:4236
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2608 -ip 2608
              1⤵
                PID:5056
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2608 -ip 2608
                1⤵
                  PID:1300
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2608 -ip 2608
                  1⤵
                    PID:3108
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2608 -ip 2608
                    1⤵
                      PID:3020
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4980
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      PID:3324
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:4208
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:768
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:3488
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 3488 -s 2924
                          3⤵
                          • Program crash
                          PID:5048
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1688
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies registry class
                        PID:4032
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 652 -p 3488 -ip 3488
                      1⤵
                        PID:2224
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:1748
                        • C:\Windows\explorer.exe
                          explorer.exe /LOADSAVEDWINDOWS
                          2⤵
                          • Modifies registry class
                          PID:3524
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:1156
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
                        1⤵
                        • Enumerates connected drives
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of SetWindowsHookEx
                        PID:2396
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:988
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:112
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                            • Modifies Installed Components in the registry
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:2992
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                          1⤵
                            PID:3028
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            1⤵
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of WriteProcessMemory
                            PID:3876
                            • C:\Windows\explorer.exe
                              explorer.exe /LOADSAVEDWINDOWS
                              2⤵
                              • Modifies Installed Components in the registry
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of SetWindowsHookEx
                              PID:3264
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2608 -ip 2608
                            1⤵
                              PID:4640

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                              Filesize

                              1KB

                              MD5

                              0eff877cfe05d09c4e51ae5251597514

                              SHA1

                              012692d09d19f8387f53041f6c2e96191e299a0e

                              SHA256

                              50a7e4d11aa80e7ac62ba1d9c8ca9f71a6807037de49cf5153c519f6eb07c0e0

                              SHA512

                              8940d4d18a38b3baf0e35bdc803b18f0bfe88d2440ba55bc33b1a0cc87a9868069ddcccbefd6fb96f80fae663ea6f472d5732bc256f02e2f36290996cd068bab

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
                              Filesize

                              434B

                              MD5

                              8ca71549b8436e273c10e4b0acc27cbb

                              SHA1

                              d08601f3eec1f6d12e3c5b3646ac8a65af04f731

                              SHA256

                              7b55b72df57cf640d35d0ec0ceeb2497aed4a76f1b04eb8e2f87a7cfe85c5b9e

                              SHA512

                              723ebc22e39f402adcb14151623eb848ddeecc19df19761e4927a69a6764c07a8ad16ca00be8ea5b8ca11083ff02a82532984122f27cc908e75bc7408bed2fb1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                              Filesize

                              1022B

                              MD5

                              fef887ef25b166c4556b08e8658fe640

                              SHA1

                              5eece3c7574417577a5c062ed61d933313be1ead

                              SHA256

                              28acc8fc796133f63814d940128356328c7dcff693913b672f1c3ebe9989c90f

                              SHA512

                              a87a642359c3961ed0ecb2db378a6ca62da6bda412fdf3bc69f645fde4cf7d518ec29c3cb3f352526a227a5d04cbc077817f80e23ea3a5aa65b75e87e6fb52d4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                              Filesize

                              1022B

                              MD5

                              fef887ef25b166c4556b08e8658fe640

                              SHA1

                              5eece3c7574417577a5c062ed61d933313be1ead

                              SHA256

                              28acc8fc796133f63814d940128356328c7dcff693913b672f1c3ebe9989c90f

                              SHA512

                              a87a642359c3961ed0ecb2db378a6ca62da6bda412fdf3bc69f645fde4cf7d518ec29c3cb3f352526a227a5d04cbc077817f80e23ea3a5aa65b75e87e6fb52d4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                              Filesize

                              28KB

                              MD5

                              6384d74c0ada90a2db3a2754ec4e6e4b

                              SHA1

                              4f3b1de93c0d9286d1d3181a8afa4862fd100ad1

                              SHA256

                              fd1cd2bef36dca838c929766ef61118062138c2ce4049cbfad19c98c97657144

                              SHA512

                              9d88b7d9e57552cff05ed8ef62c7dc926df51dac59a782c46d29428d17dda96c5a3a0520089f290ca53275648f3e3f88b3a68c8b1fa0b6248659789ee97379cc

                              Download Submit

                            • memory/2608-136-0x0000000000400000-0x0000000000A37000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/2608-132-0x0000000000400000-0x0000000000A37000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/2608-135-0x0000000000400000-0x0000000000A37000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/2608-133-0x0000000000400000-0x0000000000A37000-memory.dmp

                              Filesize

                              6.2MB

                              Download