Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 16:08

General

  • Target

    e90446bc0b3b6439ed60ae09d59967ae.exe

  • Size

    2.0MB

  • MD5

    e90446bc0b3b6439ed60ae09d59967ae

  • SHA1

    a295ad6314b3a7e348940baabaa4d6cea1502a87

  • SHA256

    353451de88f4fccd6138f8bf3c87533fc8b508320e97947c91a2a1e76d330518

  • SHA512

    3040c98037c6f75c7eeed8d5db6419c7cb51487a920ed56de7bb6ca74f0d53088431078b924d967a4c9fafcff62a5680211a77c738f5fbb49f8ee9cee71ce7a4

  • SSDEEP

    49152:tzcHOji+SJkMyF1fau20JY6l+T5C5HJhLmzrkau20JY6l+:tzeCY2MO1fau/ulTw5HrLmzrkau/ul

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Program crash 18 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e90446bc0b3b6439ed60ae09d59967ae.exe
    "C:\Users\Admin\AppData\Local\Temp\e90446bc0b3b6439ed60ae09d59967ae.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Users\Admin\AppData\Local\Temp\e90446bc0b3b6439ed60ae09d59967ae.exe
      C:\Users\Admin\AppData\Local\Temp\e90446bc0b3b6439ed60ae09d59967ae.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:4376
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\e90446bc0b3b6439ed60ae09d59967ae.exe" /TN qPTTkyZ9c33c /F
        3⤵
        • Creates scheduled task(s)
        PID:1984
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 612
        3⤵
        • Program crash
        PID:1136
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN qPTTkyZ9c33c > C:\Users\Admin\AppData\Local\Temp\lqRFDvYJ.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:404
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 628
        3⤵
        • Program crash
        PID:4312
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 636
        3⤵
        • Program crash
        PID:2684
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 708
        3⤵
        • Program crash
        PID:2096
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 708
        3⤵
        • Program crash
        PID:4776
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 780
        3⤵
        • Program crash
        PID:4536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1268
        3⤵
        • Program crash
        PID:3496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1908
        3⤵
        • Program crash
        PID:1624
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 2136
        3⤵
        • Program crash
        PID:2448
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 2096
        3⤵
        • Program crash
        PID:1944
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1924
        3⤵
        • Program crash
        PID:2420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1988
        3⤵
        • Program crash
        PID:4444
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 2120
        3⤵
        • Program crash
        PID:2124
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1932
        3⤵
        • Program crash
        PID:1248
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 2208
        3⤵
        • Program crash
        PID:2192
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1988
        3⤵
        • Program crash
        PID:556
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 2156
        3⤵
        • Program crash
        PID:1132
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 600
        3⤵
        • Program crash
        PID:4880
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4376 -ip 4376
    1⤵
      PID:4132
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Query /XML /TN qPTTkyZ9c33c
      1⤵
        PID:4148
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4376 -ip 4376
        1⤵
          PID:3740
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4376 -ip 4376
          1⤵
            PID:556
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4376 -ip 4376
            1⤵
              PID:3968
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4376 -ip 4376
              1⤵
                PID:2856
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4376 -ip 4376
                1⤵
                  PID:892
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4376 -ip 4376
                  1⤵
                    PID:4052
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4376 -ip 4376
                    1⤵
                      PID:4200
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4376 -ip 4376
                      1⤵
                        PID:1832
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4376 -ip 4376
                        1⤵
                          PID:5000
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4376 -ip 4376
                          1⤵
                            PID:3556
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4376 -ip 4376
                            1⤵
                              PID:2572
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4376 -ip 4376
                              1⤵
                                PID:368
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4376 -ip 4376
                                1⤵
                                  PID:4940
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4376 -ip 4376
                                  1⤵
                                    PID:4196
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4376 -ip 4376
                                    1⤵
                                      PID:1592
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4376 -ip 4376
                                      1⤵
                                        PID:3264
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4376 -ip 4376
                                        1⤵
                                          PID:4172

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\e90446bc0b3b6439ed60ae09d59967ae.exe

                                          Filesize

                                          167KB

                                          MD5

                                          f4d3e2c19e170473f8b4cc1fa9dc935b

                                          SHA1

                                          25e2f80f20438189203e87cf3f7e7d245ef558f1

                                          SHA256

                                          1cc3a606343777aa89b08d4def4428af6847b1370007c0c38e9e60b33a62bfe5

                                          SHA512

                                          944866665d389ca55df83be11760ab402ff44d284edef366ed23579fe7e0e346e0f026427dc7d846a5511ab5436a5a307a3874bc3501b14d70d38a520b97e38e

                                        • C:\Users\Admin\AppData\Local\Temp\lqRFDvYJ.xml

                                          Filesize

                                          1KB

                                          MD5

                                          866b27aec021575baaa951fc0326e7c6

                                          SHA1

                                          fa94c3214284c762302064f4f28d1e40107e33fe

                                          SHA256

                                          7115c4487710c69408f04abfece4c2c706925951e31ee509e68f4b9334bf7cde

                                          SHA512

                                          9f4c71ad1b0c2582d8f144fc076eaf380c673dafe152aeb21b724edbd61d953401ce535478d955732fd13bc27aa9f14d769f416345d9ef16fcaaec788235c058

                                        • memory/2056-0-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB

                                        • memory/2056-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/2056-4-0x0000000024FE0000-0x000000002505E000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/2056-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/4376-15-0x0000000024030000-0x00000000240AE000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/4376-23-0x0000000000400000-0x000000000045B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/4376-22-0x0000000000470000-0x00000000004DB000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/4376-17-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB

                                        • memory/4376-41-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB