Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe
Resource
win10v2004-20231020-en
General
-
Target
87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe
-
Size
345KB
-
MD5
1860ebf427dccac7292813bb1fa12e5b
-
SHA1
d889765ae93d9543ac9725345ab3814490d176a7
-
SHA256
87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37
-
SHA512
ed2a155d6128b7c8c958c89e823f3ec7c95ac5770f4bd8731ebcbeb70fa3a8df42a9cf54dec1121a07185766f759ed08b404840fee36c32d320de18acf70db6b
-
SSDEEP
6144:aMGZ2bjyNNGhGwfAe90daIOT7DGDdJtLYL:RUwjyNoGwxMaJQ7E
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\Control Panel\International\Geo\Nation 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2224 3372 WerFault.exe 84 -
Kills process with taskkill 1 IoCs
pid Process 2392 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2392 taskkill.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3372 wrote to memory of 1312 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 87 PID 3372 wrote to memory of 1312 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 87 PID 3372 wrote to memory of 1312 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 87 PID 3372 wrote to memory of 2196 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 90 PID 3372 wrote to memory of 2196 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 90 PID 3372 wrote to memory of 2196 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 90 PID 3372 wrote to memory of 4212 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 92 PID 3372 wrote to memory of 4212 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 92 PID 3372 wrote to memory of 4212 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 92 PID 3372 wrote to memory of 692 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 93 PID 3372 wrote to memory of 692 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 93 PID 3372 wrote to memory of 692 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 93 PID 3372 wrote to memory of 1360 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 96 PID 3372 wrote to memory of 1360 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 96 PID 3372 wrote to memory of 1360 3372 87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe 96 PID 1360 wrote to memory of 2392 1360 cmd.exe 99 PID 1360 wrote to memory of 2392 1360 cmd.exe 99 PID 1360 wrote to memory of 2392 1360 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe"C:\Users\Admin\AppData\Local\Temp\87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\2820794793.exe"2⤵PID:1312
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\1130753575.exe"2⤵PID:2196
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\5834108496.exe"2⤵PID:4212
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\5529560368.exe"2⤵PID:692
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "87c9f6da1bde1c4762477b55c8fbd4f821464f23669c08eef59df00adc438a37.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 14482⤵
- Program crash
PID:2224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3372 -ip 33721⤵PID:2248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31B
MD514bd4840f258f302f7e5e26f7760d756
SHA1fea8b87644d13e0007c75c6a33b981e4a544f0d3
SHA2568826bedef4ca1423979859bbfa57c882780d4e59394bd4dabcf1ae878aa8373e
SHA512b2016191add2ffc492a32a8c0c42ecb87f7494a909dabf5cc4fd01b857310e4583ec00a98c6fe2720791db2a51919086eec4d35c39c2d24f92279acfb3cf9cb6
-
Filesize
31B
MD514bd4840f258f302f7e5e26f7760d756
SHA1fea8b87644d13e0007c75c6a33b981e4a544f0d3
SHA2568826bedef4ca1423979859bbfa57c882780d4e59394bd4dabcf1ae878aa8373e
SHA512b2016191add2ffc492a32a8c0c42ecb87f7494a909dabf5cc4fd01b857310e4583ec00a98c6fe2720791db2a51919086eec4d35c39c2d24f92279acfb3cf9cb6
-
Filesize
31B
MD514bd4840f258f302f7e5e26f7760d756
SHA1fea8b87644d13e0007c75c6a33b981e4a544f0d3
SHA2568826bedef4ca1423979859bbfa57c882780d4e59394bd4dabcf1ae878aa8373e
SHA512b2016191add2ffc492a32a8c0c42ecb87f7494a909dabf5cc4fd01b857310e4583ec00a98c6fe2720791db2a51919086eec4d35c39c2d24f92279acfb3cf9cb6
-
Filesize
31B
MD514bd4840f258f302f7e5e26f7760d756
SHA1fea8b87644d13e0007c75c6a33b981e4a544f0d3
SHA2568826bedef4ca1423979859bbfa57c882780d4e59394bd4dabcf1ae878aa8373e
SHA512b2016191add2ffc492a32a8c0c42ecb87f7494a909dabf5cc4fd01b857310e4583ec00a98c6fe2720791db2a51919086eec4d35c39c2d24f92279acfb3cf9cb6