Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

e4c6779194...1e.exe

windows7-x64

8

e4c6779194...1e.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    176s
  • max time network
    194s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 13:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e4c6779194add0832e31e8e316cddadbcac333608f712eee8505643894a0691e.exe

  • Size

    412KB

  • MD5

    d79801de233b9897454a632f03fee472

  • SHA1

    e51818002bb845edabcedc7f2c756f1b847fcedd

  • SHA256

    e4c6779194add0832e31e8e316cddadbcac333608f712eee8505643894a0691e

  • SHA512

    9ae469ff2829fe8d06ffc03afedc30d4f8319f223418c9635af4eeac0dec8137b8c981bd9a88d43d873c577e485b6e9f29a054b1003d2e4fb4aed946437c2c28

  • SSDEEP

    6144:2HCFJq6oOsbmv87mIoFCWdlq7q2Va38Xiw892vgzetRsn66zBE:2HCFFxsKIAb6Va3a02+6

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4c6779194add0832e31e8e316cddadbcac333608f712eee8505643894a0691e.exe
    "C:\Users\Admin\AppData\Local\Temp\e4c6779194add0832e31e8e316cddadbcac333608f712eee8505643894a0691e.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\fO21703MfGeG21703\fO21703MfGeG21703.exe
      "\fO21703MfGeG21703\fO21703MfGeG21703.exe" "C:\Users\Admin\AppData\Local\Temp\e4c6779194add0832e31e8e316cddadbcac333608f712eee8505643894a0691e.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 896
        3⤵
        • Program crash
        PID:2576
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 908 -ip 908
    1⤵
      PID:1584
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 536 -ip 536
      1⤵
        PID:1168

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\fO21703MfGeG21703\fO21703MfGeG21703.exe
        Filesize

        412KB

        MD5

        ac2068f555b83e2d689dcc1d3b78ca82

        SHA1

        eb8a6f340729b11c96c8812bc2c69e742575cf51

        SHA256

        496857aa44cf728b946c1d08b044692f97ee2fc248b9018010084d128fdcc437

        SHA512

        6d7e262821394e6255b4a9ff63aa26ef97065ec68ab46640a610e5173d224d7e204c1cd5f02884fa9237432434d06a1b20756b40cc4d5d50ef56df2ba9df3531

        Download Submit

      • C:\fO21703MfGeG21703\fO21703MfGeG21703.exe
        Filesize

        412KB

        MD5

        ac2068f555b83e2d689dcc1d3b78ca82

        SHA1

        eb8a6f340729b11c96c8812bc2c69e742575cf51

        SHA256

        496857aa44cf728b946c1d08b044692f97ee2fc248b9018010084d128fdcc437

        SHA512

        6d7e262821394e6255b4a9ff63aa26ef97065ec68ab46640a610e5173d224d7e204c1cd5f02884fa9237432434d06a1b20756b40cc4d5d50ef56df2ba9df3531

        Download Submit

      • memory/536-138-0x0000000000400000-0x00000000004D7000-memory.dmp

        Filesize

        860KB

        Download

      • memory/536-139-0x0000000000400000-0x00000000004D7000-memory.dmp

        Filesize

        860KB

        Download

      • memory/908-132-0x0000000002250000-0x0000000002253000-memory.dmp

        Filesize

        12KB

        Download

      • memory/908-133-0x0000000000400000-0x00000000004D7000-memory.dmp

        Filesize

        860KB

        Download

      • memory/908-134-0x0000000000400000-0x00000000004D7000-memory.dmp

        Filesize

        860KB

        Download

      • memory/908-140-0x0000000000400000-0x00000000004D7000-memory.dmp

        Filesize

        860KB

        Download