Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2023, 09:03

General

  • Target

    Qt6Core5Compat.dll

  • Size

    815KB

  • MD5

    74555e92dba376e41f11b06bff3443dc

  • SHA1

    93eb09d5d5e1ebe90e9bedca41eac30f182dc0fb

  • SHA256

    0aa34eeaeff8f84c954ddc5b334d91fd51a9f19b1a1f3f18ef292a1fb43e94c3

  • SHA512

    85d7304608c104ca18fda66a6b16388c164fee9b4bef4ed0de2656b081e5ba5ff94851eed5590f7da101897dc3eb2561d5ecbdc86469ceb09a662dc51380cd26

  • SSDEEP

    12288:ZdFrujqAFH1h/biPGE/4717VKItBDPzHkSxGGffzYfMAbNkdEx:xruTHvKG7VdDPT6df9badW

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 3 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\Qt6Core5Compat.dll,#1
    1⤵
      PID:552
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 552 -s 504
        2⤵
        • Program crash
        PID:1204
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 408 -p 552 -ip 552
      1⤵
        PID:4244
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k netsvcs -p
        1⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:2040

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\wsu9E34.tmp

        Filesize

        14KB

        MD5

        c01eaa0bdcd7c30a42bbb35a9acbf574

        SHA1

        0aee3e1b873e41d040f1991819d0027b6cc68f54

        SHA256

        32297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40

        SHA512

        d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7

      • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat

        Filesize

        29KB

        MD5

        4b0ae138cd397914692877ba6e4c882a

        SHA1

        16030a0add74b70de6c48b1212b938cc06a03a6a

        SHA256

        35be464b126586e05925e15121eea77b040c89de3e552db89986a247ed3a4ff9

        SHA512

        d9fcc7e32771ca81ae4c9c2adfe3124c7e230b70ced5ef626e41523a5fd4f5b96a95b9e4fe5bd65ee43f5d7a76b4d4b3956e8b67d966978185a83ed16a480783