Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 13:21

General

  • Target

    a03bf226f2e2838df4265212dccc22b6.exe

  • Size

    1.6MB

  • MD5

    a03bf226f2e2838df4265212dccc22b6

  • SHA1

    5d5d3861b8cb260dcb6ca001231a961d7801efae

  • SHA256

    511821d91ce18d90e83853032148ca4c42f182507a58fdf8fa7cdc985b91d2c5

  • SHA512

    f2561751fc0519155e1edada610a9a1b23d03bcfebf2c70310115ec59ca0e2730f9a888ecbbf58db105018aa31bfbe32d634bdcae5829f73aa63dcbc0ade7899

  • SSDEEP

    49152:MTfTPpdtcakLz0ISej5OVT1h8LbBgD1fNacakLz0O:MTfTxdtcakcIdFOxgLbk1fNacakcO

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Program crash 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a03bf226f2e2838df4265212dccc22b6.exe
    "C:\Users\Admin\AppData\Local\Temp\a03bf226f2e2838df4265212dccc22b6.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:220
    • C:\Users\Admin\AppData\Local\Temp\a03bf226f2e2838df4265212dccc22b6.exe
      C:\Users\Admin\AppData\Local\Temp\a03bf226f2e2838df4265212dccc22b6.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:5048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 628
        3⤵
        • Program crash
        PID:3576
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 724
        3⤵
        • Program crash
        PID:2284
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 660
        3⤵
        • Program crash
        PID:1040
  • C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Query /XML /TN nMQUF5AE494a
    1⤵
      PID:2824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 5048
      1⤵
        PID:2276
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN nMQUF5AE494a > C:\Users\Admin\AppData\Local\Temp\XanouqF.xml
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 616
        1⤵
        • Program crash
        PID:3244
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\a03bf226f2e2838df4265212dccc22b6.exe" /TN nMQUF5AE494a /F
        1⤵
        • Creates scheduled task(s)
        PID:3288
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5048 -ip 5048
        1⤵
          PID:216
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5048 -ip 5048
          1⤵
            PID:4292
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5048 -ip 5048
            1⤵
              PID:1304

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\XanouqF.xml

              Filesize

              1KB

              MD5

              f4c336e35f2261c4ecfc6485a526cd70

              SHA1

              06d7e2778f3536965dea481eef89bd67f3062c91

              SHA256

              3042516eeef90870682691a76c60e55b1fa65e6e5f8a22f01a8de08007470a24

              SHA512

              46aa76c39f703bbda322da07f3473dc3df4dd2845c4f7ec2ced48bfdb7384c0663bf861f7bd8cf6e53eef2c40b5e42420c2680365df4ceaf866e7ede761ea1fa

            • C:\Users\Admin\AppData\Local\Temp\a03bf226f2e2838df4265212dccc22b6.exe

              Filesize

              170KB

              MD5

              ca900c66e1194d784e6a454c37916cf8

              SHA1

              82e5d12c9a921737864b7b679a377019c7b479b8

              SHA256

              303c100e810a8b06a7f902569d726e9b533c1de55867a4008f87617cf5be0f8e

              SHA512

              825dd04dd13b46dd6e45d564fcf985fd9ba3040fbb5c27a9381437f193840f9885fd641300bcaa2f500424682b51461ca7adc98191178dd763eae0292819b14e

            • memory/220-0-0x0000000000400000-0x000000000065C000-memory.dmp

              Filesize

              2.4MB

            • memory/220-4-0x0000000001730000-0x00000000017AE000-memory.dmp

              Filesize

              504KB

            • memory/220-1-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

            • memory/220-13-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

            • memory/5048-14-0x0000000000400000-0x000000000065C000-memory.dmp

              Filesize

              2.4MB

            • memory/5048-20-0x0000000001730000-0x00000000017AE000-memory.dmp

              Filesize

              504KB

            • memory/5048-23-0x0000000000400000-0x000000000045B000-memory.dmp

              Filesize

              364KB

            • memory/5048-22-0x0000000000470000-0x00000000004DB000-memory.dmp

              Filesize

              428KB

            • memory/5048-41-0x0000000000400000-0x000000000065C000-memory.dmp

              Filesize

              2.4MB