Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    184s
  • max time network
    194s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 09:42

General

  • Target

    6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe

  • Size

    827KB

  • MD5

    e28208b17f0b5f896d478f10271b5871

  • SHA1

    52c5e0e1db6d5976c3d34f5155c00aa9b6905fa1

  • SHA256

    6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047

  • SHA512

    f82c36deb16ad6b9826e3e187cd49ed942cb25d12c89fb1c2e544d82d896ae750d0f765aaffb725fc4c854756ba07c8a3dcab2d5f0f66ee158ccd47d9b8e4731

  • SSDEEP

    24576:SJ4D/4vCJTRu+diWLVPV3OBI8IQqruSRo6:iK7VPlOBI0re

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe
    "C:\Users\Admin\AppData\Local\Temp\6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe"
    1⤵
    • Adds Run key to start application
    • Modifies Internet Explorer settings
    PID:4312
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 768
      2⤵
      • Program crash
      PID:4772
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4312 -ip 4312
    1⤵
      PID:4780

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4312-132-0x0000000000400000-0x00000000007B3000-memory.dmp

      Filesize

      3.7MB

    • memory/4312-134-0x0000000000400000-0x00000000007B3000-memory.dmp

      Filesize

      3.7MB

    • memory/4312-135-0x0000000000400000-0x00000000007B3000-memory.dmp

      Filesize

      3.7MB

    • memory/4312-136-0x0000000000400000-0x00000000007B3000-memory.dmp

      Filesize

      3.7MB