Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
184s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 09:42
Static task
static1
Behavioral task
behavioral1
Sample
6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe
Resource
win10v2004-20220812-en
General
-
Target
6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe
-
Size
827KB
-
MD5
e28208b17f0b5f896d478f10271b5871
-
SHA1
52c5e0e1db6d5976c3d34f5155c00aa9b6905fa1
-
SHA256
6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047
-
SHA512
f82c36deb16ad6b9826e3e187cd49ed942cb25d12c89fb1c2e544d82d896ae750d0f765aaffb725fc4c854756ba07c8a3dcab2d5f0f66ee158ccd47d9b8e4731
-
SSDEEP
24576:SJ4D/4vCJTRu+diWLVPV3OBI8IQqruSRo6:iK7VPlOBI0re
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4312-132-0x0000000000400000-0x00000000007B3000-memory.dmp upx behavioral2/memory/4312-134-0x0000000000400000-0x00000000007B3000-memory.dmp upx behavioral2/memory/4312-135-0x0000000000400000-0x00000000007B3000-memory.dmp upx behavioral2/memory/4312-136-0x0000000000400000-0x00000000007B3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe" 6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4772 4312 WerFault.exe 77 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main 6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DefaultCompressedRecord = 2b80f97f73f571f6ccadb90215993d42ddf24ba6f8e8999390cb0b3a29f96babefc9f994539093ce790f39f893a0952e20896f48da8b3bb4a5ebac1d9188fa4862f82e40acbdb120049ebcecb4ac95643f50df8240677fc1809b7ffaeb2f83b6cbf681b5191663 6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RecordModifiedMax = "DP8XXWXHabmV0lXEc4t+KPm/4HtiyS4dXK08KS5s8kvXdO4nS109W9/YH1JjZ+k9rA==" 6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FlagsModifiedValid = 0000000000000000 6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe"C:\Users\Admin\AppData\Local\Temp\6e691decf867785b3514237f7e8ec10fba707e64fc783743f7b16306e9cba047.exe"1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
PID:4312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 7682⤵
- Program crash
PID:4772
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4312 -ip 43121⤵PID:4780