Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
Aylık Hesap Hareketleri.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Aylık Hesap Hareketleri.exe
Resource
win10v2004-20230703-en
General
-
Target
Aylık Hesap Hareketleri.exe
-
Size
825KB
-
MD5
3aaceeae83f5046f5a0a32cd797ab550
-
SHA1
28089985305192bc3445a6782fbe9100b12168cb
-
SHA256
d31d25db8f90f851d56eda5ac2e95f0b030c0d42ea908386f52e95ff313bdfc4
-
SHA512
3bbe0a7617f99494496c577b95febb2372d9d2d302001a7e84f21a56abfbe33b05c5954690206021813be42e432ee1fa39fbc8dc2105e2897ea53c0fbadb325d
-
SSDEEP
12288:4bqwi/iWsjDT9N74+g7ZIIJhVoq3kHTTo7tYoD0jE4lS/AnJL:0qwiiWOT7i7WI9dko7tYnowSIL
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 5068 3928 WerFault.exe 81 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3928 Aylık Hesap Hareketleri.exe 3928 Aylık Hesap Hareketleri.exe 3928 Aylık Hesap Hareketleri.exe 4124 powershell.exe 3928 Aylık Hesap Hareketleri.exe 4124 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3928 Aylık Hesap Hareketleri.exe Token: SeDebugPrivilege 4124 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3928 wrote to memory of 4124 3928 Aylık Hesap Hareketleri.exe 91 PID 3928 wrote to memory of 4124 3928 Aylık Hesap Hareketleri.exe 91 PID 3928 wrote to memory of 4124 3928 Aylık Hesap Hareketleri.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aylık Hesap Hareketleri.exe"C:\Users\Admin\AppData\Local\Temp\Aylık Hesap Hareketleri.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Aylık Hesap Hareketleri.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 14442⤵
- Program crash
PID:5068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3928 -ip 39281⤵PID:3084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82