Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
30/12/2023, 23:10
General
-
Target
1f8bfdf427b6afa99a60c0d907bbd35c.exe
-
Size
496KB
-
MD5
1f8bfdf427b6afa99a60c0d907bbd35c
-
SHA1
bafb13d0635320fd4335bb584e08c656cdc89085
-
SHA256
1d60a629b0d6b3f574a7f2450146f7ce440fd5efa827af2b3ca36fbb5d7ba429
-
SHA512
e9c37ef9a4e7a929427ba16899272dd47927539f2f703d1dc30fe149e26ba6e0071343c88e917d072a2595cb36ce28dc0a29ff1f7ca16a8c31cf4a8f44bbc7bf
-
SSDEEP
6144:Lv0hed0DtN2JEJlOynVscJFfqRZsmCEtjpGsdjJQVJf6xx5L67:L+75VscLcZXDdjun6v5L6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Program crash 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f8bfdf427b6afa99a60c0d907bbd35c.exe"C:\Users\Admin\AppData\Local\Temp\1f8bfdf427b6afa99a60c0d907bbd35c.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Kqagua.exeC:\Windows\Kqagua.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 7803⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2752 -ip 27521⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
496KB
MD51f8bfdf427b6afa99a60c0d907bbd35c
SHA1bafb13d0635320fd4335bb584e08c656cdc89085
SHA2561d60a629b0d6b3f574a7f2450146f7ce440fd5efa827af2b3ca36fbb5d7ba429
SHA512e9c37ef9a4e7a929427ba16899272dd47927539f2f703d1dc30fe149e26ba6e0071343c88e917d072a2595cb36ce28dc0a29ff1f7ca16a8c31cf4a8f44bbc7bf
-
Filesize
362B
MD5c28aa7eddf8594d43548747ee2457513
SHA144548882e22057be5ff1ce386844c2e0c32f76b3
SHA25693dda77bd8f47262705c90f8277d657e75b76953c05e1cf5eeca36819f49fa1a
SHA512e1880bc5c8f5c8697bb5bedbdb24cbcc82fbc375c044aef7759f74028f03d9a577cd262db4c77c850158341d61e29e791485d4b2121d1457efad530f39b0e460
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
504KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
504KB
-
Filesize
232KB
-
Filesize
504KB
-
Filesize
4KB
-
Filesize
504KB