Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

16d11d38d2...00.exe

windows7-x64

8

16d11d38d2...00.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    159s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2023, 01:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    16d11d38d21891939f768acbdb6bf9326ed69100.exe

  • Size

    354KB

  • MD5

    06bcb9616a54e2762e3ff8ffb3ac7c83

  • SHA1

    16d11d38d21891939f768acbdb6bf9326ed69100

  • SHA256

    7c530b0b55443db7e966b7420b27fb6ed79f8e70fc349fb00087f6d1e4b7cc25

  • SHA512

    b4f9b869e420ba6ae7e54462556a2da4379d9b5d8b0fe8beb4e22668abb35e4070be22bc0d272a287153bc0328c18962e750037d8f086284c438021cfcd21825

  • SSDEEP

    6144:kYa6TmPuL+3v6pfqe10A0MJHCwOTiRAf1yWwBYUig51cF96EQ1:kYBR+3MCeu0dy4Af1yWeYUigDcF96EQ1

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Users\Admin\AppData\Local\Temp\16d11d38d21891939f768acbdb6bf9326ed69100.exe
      "C:\Users\Admin\AppData\Local\Temp\16d11d38d21891939f768acbdb6bf9326ed69100.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe
        "C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe" C:\Users\Admin\AppData\Local\Temp\kudajbqj.g
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe
          "C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1844
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2464
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:4484
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 4484 -s 184
            4⤵
            • Program crash
            PID:1700
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 360 -p 4484 -ip 4484
      1⤵
        PID:2256

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\kudajbqj.g
        Filesize

        5KB

        MD5

        aeb6a2dc2a4a22cf5de4f56661f20e16

        SHA1

        0fa071ff4fd4bf35d96f8fb4f7b45ab0b8521515

        SHA256

        168ffda172997e02f01e7c8c4cd2b30ffc4b7366f1acfbe029353d13c99990a1

        SHA512

        b88afc2d2515b4ae106f63af889f94d09d85bb35bc9ec6e915c3e60c06b1ac7df925348a0b0806f126906280907117b6db9bd4f42eadbccaaf1aed29d8dda6fa

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nynof.ibc
        Filesize

        206KB

        MD5

        d5ca5091a7377bc2fd2fbb271dcd8338

        SHA1

        f2629ea5132238f563f4ab615b05c2dce8fcf796

        SHA256

        5e6f7370f76d2986adafb7c2aebda820bf28d334c61b553eb15dddbd58078814

        SHA512

        3096e32fa82b7c67cc869c49f2b11353cb06ab9a6316f96c158f1b41963778f04f2b65e0b1424d858aa83f90d8c3dcc7ad1eb18c779625e2f49ad36d64fef9dc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe
        Filesize

        52KB

        MD5

        3bc5576964618b8c5f6241c4247ca04b

        SHA1

        0876a0b44bfccdfdccf609898b803bdf6845ec5d

        SHA256

        0a82b92f315096ef1ca9518947a34b751ed49b366d1a2196fbcde1b517e4a998

        SHA512

        1aecaae7a5c6dcc7cf43f8e913ce5059e85d9ee5580e01779b27040fb7661e0e95f559d19afbafba62b21ff03d9689ae739552a9c63e57923a20d08e0c440454

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe
        Filesize

        52KB

        MD5

        3bc5576964618b8c5f6241c4247ca04b

        SHA1

        0876a0b44bfccdfdccf609898b803bdf6845ec5d

        SHA256

        0a82b92f315096ef1ca9518947a34b751ed49b366d1a2196fbcde1b517e4a998

        SHA512

        1aecaae7a5c6dcc7cf43f8e913ce5059e85d9ee5580e01779b27040fb7661e0e95f559d19afbafba62b21ff03d9689ae739552a9c63e57923a20d08e0c440454

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\qdoktiy.exe
        Filesize

        52KB

        MD5

        3bc5576964618b8c5f6241c4247ca04b

        SHA1

        0876a0b44bfccdfdccf609898b803bdf6845ec5d

        SHA256

        0a82b92f315096ef1ca9518947a34b751ed49b366d1a2196fbcde1b517e4a998

        SHA512

        1aecaae7a5c6dcc7cf43f8e913ce5059e85d9ee5580e01779b27040fb7661e0e95f559d19afbafba62b21ff03d9689ae739552a9c63e57923a20d08e0c440454

        Download Submit

      • memory/1844-144-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

        Download

      • memory/1844-139-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

        Download

      • memory/1844-140-0x0000000000AA0000-0x0000000000DEA000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/1844-141-0x0000000000630000-0x0000000000640000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2464-147-0x0000000001060000-0x00000000013AA000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/2464-146-0x00000000008D0000-0x00000000008FD000-memory.dmp

        Filesize

        180KB

        Download

      • memory/2464-145-0x0000000000520000-0x0000000000537000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2464-148-0x0000000000E00000-0x0000000000E8F000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2464-150-0x00000000008D0000-0x00000000008FD000-memory.dmp

        Filesize

        180KB

        Download

      • memory/2648-142-0x0000000002F00000-0x0000000002FE9000-memory.dmp

        Filesize

        932KB

        Download

      • memory/2648-149-0x0000000003030000-0x0000000003117000-memory.dmp

        Filesize

        924KB

        Download

      • memory/2648-151-0x0000000003030000-0x0000000003117000-memory.dmp

        Filesize

        924KB

        Download