Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3Dump/dump1.exe
windows7-x64
3Dump/dump1.exe
windows10-2004-x64
3Original/9...6f.exe
windows7-x64
7Original/9...6f.exe
windows10-2004-x64
7Original/D...12.scr
windows7-x64
7Original/D...12.scr
windows10-2004-x64
7Original/b...12.exe
windows7-x64
7Original/b...12.exe
windows10-2004-x64
7Original/chqpl.exe
windows7-x64
7Original/chqpl.exe
windows10-2004-x64
7Original/d...4a.exe
windows7-x64
7Original/d...4a.exe
windows10-2004-x64
7Original/f...14.exe
windows7-x64
7Original/f...14.exe
windows10-2004-x64
7Original/l...25.exe
windows7-x64
7Original/l...25.exe
windows10-2004-x64
3Original/p...b9.dll
windows7-x64
8Original/p...b9.dll
windows10-2004-x64
8Unpacked/D...ed.exe
windows7-x64
7Unpacked/D...ed.exe
windows10-2004-x64
7Analysis
-
max time kernel
128s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2023, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
Dump/dump1.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Dump/dump1.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
Original/999bc5e16312db6abff5f6c9e54c546f.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Original/Document-772976_829712.scr
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
Original/Document-772976_829712.scr
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
Original/chqpl.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
Original/chqpl.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
Original/dd207384b31d118745ebc83203a4b04a.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
Original/fax_390392029_072514.exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
Original/fax_390392029_072514.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
Original/loader_9b313e9c79921b22b488a11344b280d4cec9dd09c2201f9e5aaf08a115650b25.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
Original/payload_f8eccfebda8a1e0caabbe23a8b94d7ced980353a9b3673a4173e24958a3bdbb9.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
Unpacked/Dyre_Unpacked.exe
Resource
win10v2004-20230703-en
General
-
Target
Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
-
Size
480KB
-
MD5
b44634d90a9ff2ed8a9d0304c11bf612
-
SHA1
8f72e02dcbd87a4c1b880d349e34e0deb8e7bdd4
-
SHA256
27d3378f41d3bd82d84544f7331856001a5fca259b6ef9001c15cdc43207c73e
-
SHA512
7e48e19817a132c8c29f56c271865ad7ef375291229e9b844c3d3c7ff8927b23fe4eb87494ef89f3dae0e1795648ae910e576ca0c42c231c15aaca60bb619239
-
SSDEEP
6144:iWWPaCGkGGCBJKeNm1VbeuJCeU2HM7R+mzZUxrKkhhcghPrQANJRjiP6EQ6a9k7v:ReGkGJN8VyUxrvoZgJRjJ6a9TgS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1492 GNewDTxgNKQVuGF.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\GNewDTxgNKQVuGF.exe b44634d90a9ff2ed8a9d0304c11bf612.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2004 1492 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4208 b44634d90a9ff2ed8a9d0304c11bf612.exe 4208 b44634d90a9ff2ed8a9d0304c11bf612.exe 1492 GNewDTxgNKQVuGF.exe 1492 GNewDTxgNKQVuGF.exe 1492 GNewDTxgNKQVuGF.exe 1492 GNewDTxgNKQVuGF.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4208 b44634d90a9ff2ed8a9d0304c11bf612.exe Token: SeDebugPrivilege 1492 GNewDTxgNKQVuGF.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4208 wrote to memory of 1492 4208 b44634d90a9ff2ed8a9d0304c11bf612.exe 85 PID 4208 wrote to memory of 1492 4208 b44634d90a9ff2ed8a9d0304c11bf612.exe 85 PID 4208 wrote to memory of 1492 4208 b44634d90a9ff2ed8a9d0304c11bf612.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Original\b44634d90a9ff2ed8a9d0304c11bf612.exe"C:\Users\Admin\AppData\Local\Temp\Original\b44634d90a9ff2ed8a9d0304c11bf612.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\GNewDTxgNKQVuGF.exeC:\Users\Admin\AppData\Local\Temp\Original\b44634d90a9ff2ed8a9d0304c11bf612.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 7483⤵
- Program crash
PID:2004
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1492 -ip 14921⤵PID:3036
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480KB
MD5b44634d90a9ff2ed8a9d0304c11bf612
SHA18f72e02dcbd87a4c1b880d349e34e0deb8e7bdd4
SHA25627d3378f41d3bd82d84544f7331856001a5fca259b6ef9001c15cdc43207c73e
SHA5127e48e19817a132c8c29f56c271865ad7ef375291229e9b844c3d3c7ff8927b23fe4eb87494ef89f3dae0e1795648ae910e576ca0c42c231c15aaca60bb619239
-
Filesize
480KB
MD5b44634d90a9ff2ed8a9d0304c11bf612
SHA18f72e02dcbd87a4c1b880d349e34e0deb8e7bdd4
SHA25627d3378f41d3bd82d84544f7331856001a5fca259b6ef9001c15cdc43207c73e
SHA5127e48e19817a132c8c29f56c271865ad7ef375291229e9b844c3d3c7ff8927b23fe4eb87494ef89f3dae0e1795648ae910e576ca0c42c231c15aaca60bb619239