Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

PRE ALERT NOTICE.exe

windows7-x64

8

PRE ALERT NOTICE.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2023, 14:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PRE ALERT NOTICE.exe

  • Size

    354KB

  • MD5

    06bcb9616a54e2762e3ff8ffb3ac7c83

  • SHA1

    16d11d38d21891939f768acbdb6bf9326ed69100

  • SHA256

    7c530b0b55443db7e966b7420b27fb6ed79f8e70fc349fb00087f6d1e4b7cc25

  • SHA512

    b4f9b869e420ba6ae7e54462556a2da4379d9b5d8b0fe8beb4e22668abb35e4070be22bc0d272a287153bc0328c18962e750037d8f086284c438021cfcd21825

  • SSDEEP

    6144:kYa6TmPuL+3v6pfqe10A0MJHCwOTiRAf1yWwBYUig51cF96EQ1:kYBR+3MCeu0dy4Af1yWeYUigDcF96EQ1

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Users\Admin\AppData\Local\Temp\PRE ALERT NOTICE.exe
      "C:\Users\Admin\AppData\Local\Temp\PRE ALERT NOTICE.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3576
      • C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe
        "C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe" C:\Users\Admin\AppData\Local\Temp\kudajbqj.g
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:856
        • C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe
          "C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:5000
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4064
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:3412
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3412 -s 184
            4⤵
            • Program crash
            PID:3036
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 460 -p 3412 -ip 3412
      1⤵
        PID:4372

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\kudajbqj.g
        Filesize

        5KB

        MD5

        aeb6a2dc2a4a22cf5de4f56661f20e16

        SHA1

        0fa071ff4fd4bf35d96f8fb4f7b45ab0b8521515

        SHA256

        168ffda172997e02f01e7c8c4cd2b30ffc4b7366f1acfbe029353d13c99990a1

        SHA512

        b88afc2d2515b4ae106f63af889f94d09d85bb35bc9ec6e915c3e60c06b1ac7df925348a0b0806f126906280907117b6db9bd4f42eadbccaaf1aed29d8dda6fa

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nynof.ibc
        Filesize

        206KB

        MD5

        d5ca5091a7377bc2fd2fbb271dcd8338

        SHA1

        f2629ea5132238f563f4ab615b05c2dce8fcf796

        SHA256

        5e6f7370f76d2986adafb7c2aebda820bf28d334c61b553eb15dddbd58078814

        SHA512

        3096e32fa82b7c67cc869c49f2b11353cb06ab9a6316f96c158f1b41963778f04f2b65e0b1424d858aa83f90d8c3dcc7ad1eb18c779625e2f49ad36d64fef9dc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe
        Filesize

        52KB

        MD5

        3bc5576964618b8c5f6241c4247ca04b

        SHA1

        0876a0b44bfccdfdccf609898b803bdf6845ec5d

        SHA256

        0a82b92f315096ef1ca9518947a34b751ed49b366d1a2196fbcde1b517e4a998

        SHA512

        1aecaae7a5c6dcc7cf43f8e913ce5059e85d9ee5580e01779b27040fb7661e0e95f559d19afbafba62b21ff03d9689ae739552a9c63e57923a20d08e0c440454

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe
        Filesize

        52KB

        MD5

        3bc5576964618b8c5f6241c4247ca04b

        SHA1

        0876a0b44bfccdfdccf609898b803bdf6845ec5d

        SHA256

        0a82b92f315096ef1ca9518947a34b751ed49b366d1a2196fbcde1b517e4a998

        SHA512

        1aecaae7a5c6dcc7cf43f8e913ce5059e85d9ee5580e01779b27040fb7661e0e95f559d19afbafba62b21ff03d9689ae739552a9c63e57923a20d08e0c440454

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe
        Filesize

        52KB

        MD5

        3bc5576964618b8c5f6241c4247ca04b

        SHA1

        0876a0b44bfccdfdccf609898b803bdf6845ec5d

        SHA256

        0a82b92f315096ef1ca9518947a34b751ed49b366d1a2196fbcde1b517e4a998

        SHA512

        1aecaae7a5c6dcc7cf43f8e913ce5059e85d9ee5580e01779b27040fb7661e0e95f559d19afbafba62b21ff03d9689ae739552a9c63e57923a20d08e0c440454

        Download Submit

      • memory/3080-150-0x0000000002D10000-0x0000000002DF2000-memory.dmp

        Filesize

        904KB

        Download

      • memory/3080-149-0x0000000002D10000-0x0000000002DF2000-memory.dmp

        Filesize

        904KB

        Download

      • memory/3080-142-0x0000000002900000-0x0000000002A1F000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/4064-146-0x0000000002D70000-0x00000000030BA000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/4064-148-0x0000000002BA0000-0x0000000002C2F000-memory.dmp

        Filesize

        572KB

        Download

      • memory/4064-147-0x0000000000E80000-0x0000000000EAD000-memory.dmp

        Filesize

        180KB

        Download

      • memory/4064-145-0x0000000000E60000-0x0000000000E66000-memory.dmp

        Filesize

        24KB

        Download

      • memory/5000-140-0x0000000000A40000-0x0000000000D8A000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/5000-144-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

        Download

      • memory/5000-141-0x00000000001D0000-0x00000000001E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/5000-139-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

        Download