Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 21:33
General
-
Target
1d203bc511e64a8f9a40010595dfb5df.exe
-
Size
190KB
-
MD5
1d203bc511e64a8f9a40010595dfb5df
-
SHA1
8a4dbf3c4367a67b2655c65ff4897d9496b4e6ef
-
SHA256
18b2069118ac058b90cb5f1e7afd220d5ee44cbddebfaaf411d094d90a892268
-
SHA512
64f510b23a6fecc597145cdb4e871dbdc7d2d776a8322ea30108d7c7c02e24eefe9af514c3eae6684851d9cf357e672543999a4d914852f4d4137eb1738d4ccd
-
SSDEEP
3072:5tY7o4FYVdPEbWy3KCPS2KhBuO7hgFdagOaHtamDYQ14TRsS5In42LwQObw6UzgT:5z0Ud5y3/S2iB57hgFAgRHNYc4TRy4eC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d203bc511e64a8f9a40010595dfb5df.exe"C:\Users\Admin\AppData\Local\Temp\1d203bc511e64a8f9a40010595dfb5df.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Kwadoa.exeC:\Windows\Kwadoa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 7763⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2440 -ip 24401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190KB
MD51d203bc511e64a8f9a40010595dfb5df
SHA18a4dbf3c4367a67b2655c65ff4897d9496b4e6ef
SHA25618b2069118ac058b90cb5f1e7afd220d5ee44cbddebfaaf411d094d90a892268
SHA51264f510b23a6fecc597145cdb4e871dbdc7d2d776a8322ea30108d7c7c02e24eefe9af514c3eae6684851d9cf357e672543999a4d914852f4d4137eb1738d4ccd
-
Filesize
362B
MD591b54d7c0219df3e37937d2b528da504
SHA166e87ff17f9535348651cc7aeea83dcc83b6ecc8
SHA256101a0aca2b04643a655c8dc9a66a4edae20542ef2b02a355ea82788aa351d7a1
SHA512048d14e79b1b541953809bc093eac7d33d997019ccb28548a2523ab67788e7e0614611002a220c9773989cd02a41a8afb2b11698ada97ca4774e6b2b8bd5729b
-
Filesize
244KB
-
Filesize
396KB
-
Filesize
244KB
-
Filesize
396KB
-
Filesize
4KB
-
Filesize
244KB
-
Filesize
396KB
-
Filesize
244KB