Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/12/2022, 01:47
Static task
static1
Behavioral task
behavioral1
Sample
e7436b2d8299561e2603956ff1a1a40f891f417d06fee090405f8490416b68df.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e7436b2d8299561e2603956ff1a1a40f891f417d06fee090405f8490416b68df.exe
Resource
win10v2004-20220812-en
General
-
Target
e7436b2d8299561e2603956ff1a1a40f891f417d06fee090405f8490416b68df.exe
-
Size
171KB
-
MD5
b8ee9b78c4ade258a67385d69732ae3d
-
SHA1
2ae775c66d9bdf78563fd82a054f6eb1a3426aae
-
SHA256
e7436b2d8299561e2603956ff1a1a40f891f417d06fee090405f8490416b68df
-
SHA512
534700a5d98c580d4cbc64ad6b942a64987b929e06166df681ca6721a35baac6b6b1bb2e34968d688852b3def74e0ac9d840a11d951674ac6c8a9537d09ad0ca
-
SSDEEP
3072:3JLkeg9pVM1orjoB+EgZuurc1qVel1/SB85CaHBtx3GOen6cF:5Lo3VMUjD1mwoj/SB85CaHBP9en1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3184 nkvxlye.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\nkvxlye.exe e7436b2d8299561e2603956ff1a1a40f891f417d06fee090405f8490416b68df.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4928 3184 WerFault.exe 80 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3184 nkvxlye.exe 3184 nkvxlye.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3184 nkvxlye.exe -
Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3184 wrote to memory of 2228 3184 nkvxlye.exe 54
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\e7436b2d8299561e2603956ff1a1a40f891f417d06fee090405f8490416b68df.exe"C:\Users\Admin\AppData\Local\Temp\e7436b2d8299561e2603956ff1a1a40f891f417d06fee090405f8490416b68df.exe"2⤵
- Drops file in Program Files directory
PID:1092
-
-
C:\PROGRA~3\Mozilla\nkvxlye.exeC:\PROGRA~3\Mozilla\nkvxlye.exe -xqialii1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 5562⤵
- Program crash
PID:4928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3184 -ip 31841⤵PID:5032
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171KB
MD56a307a8a540a699df8dff07dea060156
SHA1cbee790e057c741019d6d76be3982e7f13828c87
SHA25600395e1038eae517ac471b295a2c174988ae526f21211ef59d4ea28657c42eca
SHA51220b23d6dfba14d646d3d23b034444711e9f59f5974a47b3f7ae54a78bc24bf91d5e37a0633a313073d4962ebc65976688ce0ac3cec78f299d2efb6617b88f3f3
-
Filesize
171KB
MD56a307a8a540a699df8dff07dea060156
SHA1cbee790e057c741019d6d76be3982e7f13828c87
SHA25600395e1038eae517ac471b295a2c174988ae526f21211ef59d4ea28657c42eca
SHA51220b23d6dfba14d646d3d23b034444711e9f59f5974a47b3f7ae54a78bc24bf91d5e37a0633a313073d4962ebc65976688ce0ac3cec78f299d2efb6617b88f3f3