Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
14/11/2023, 18:59
Static task
static1
Behavioral task
behavioral1
Sample
8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe
Resource
win10v2004-20231023-en
General
-
Target
8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe
-
Size
1.2MB
-
MD5
7fcbcb240c76cb44e1b092c8dddb5310
-
SHA1
5674ba5b947e0fff3e3649b4c1cf56fd9a32c30f
-
SHA256
8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b
-
SHA512
3929c380609b1ac85e85f21e6a71f8ac2c10334c5e9b18a8483160775962608dd1b9b16cd524316da3e5003cf6e8f16f61a6e9e41e7d285706fb6b942fe1c7cf
-
SSDEEP
24576:VdubV+/mOo7KA3IgpGw0FZt7oHKix+BzAIGdTnuiND:j0V+/I7T3NpVw7o70BcFhnZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4624 8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe -
Executes dropped EXE 1 IoCs
pid Process 4624 8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 14 IoCs
pid pid_target Process procid_target 4440 2696 WerFault.exe 86 3392 4624 WerFault.exe 95 1888 4624 WerFault.exe 95 5008 4624 WerFault.exe 95 1608 4624 WerFault.exe 95 388 4624 WerFault.exe 95 4472 4624 WerFault.exe 95 4280 4624 WerFault.exe 95 532 4624 WerFault.exe 95 3628 4624 WerFault.exe 95 1444 4624 WerFault.exe 95 4936 4624 WerFault.exe 95 1644 4624 WerFault.exe 95 2464 4624 WerFault.exe 95 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4624 8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe 4624 8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2696 8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4624 8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2696 wrote to memory of 4624 2696 8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe 95 PID 2696 wrote to memory of 4624 2696 8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe 95 PID 2696 wrote to memory of 4624 2696 8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe"C:\Users\Admin\AppData\Local\Temp\8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 3442⤵
- Program crash
PID:4440
-
-
C:\Users\Admin\AppData\Local\Temp\8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exeC:\Users\Admin\AppData\Local\Temp\8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:4624 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 3443⤵
- Program crash
PID:3392
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 6243⤵
- Program crash
PID:1888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 6243⤵
- Program crash
PID:5008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 6523⤵
- Program crash
PID:1608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 7203⤵
- Program crash
PID:388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 9283⤵
- Program crash
PID:4472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 14003⤵
- Program crash
PID:4280
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 14123⤵
- Program crash
PID:532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 16843⤵
- Program crash
PID:3628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 15083⤵
- Program crash
PID:1444
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 14483⤵
- Program crash
PID:4936
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 16443⤵
- Program crash
PID:1644
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 6323⤵
- Program crash
PID:2464
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2696 -ip 26961⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4624 -ip 46241⤵PID:4936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4624 -ip 46241⤵PID:4576
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4624 -ip 46241⤵PID:3060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4624 -ip 46241⤵PID:4800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4624 -ip 46241⤵PID:3396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4624 -ip 46241⤵PID:3636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4624 -ip 46241⤵PID:4328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4624 -ip 46241⤵PID:2884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4624 -ip 46241⤵PID:2236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4624 -ip 46241⤵PID:2404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4624 -ip 46241⤵PID:4080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4624 -ip 46241⤵PID:1948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4624 -ip 46241⤵PID:4968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8a26f0de546bd2349a654d8012dc5d28197221a678c33e8371e411d180ffd79b.exe
Filesize1.2MB
MD5843f9be704b0b73bb2cdaf6ad5638778
SHA1804635a95caf38edc496051fa910c622578883f2
SHA256e29ea87c0db9a10e2be39fa59f907ff0aae50a3505245ebe5cf84c61fbe67c94
SHA512c872b8f9b678e148846d89002c079a679a34f250489fb85c12c12202ebec383217e0dd647c2e5e82f9ef34186b103a923e5056f8fa3bf841f4bd9c9c1bccf439