Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
168s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
09614e70ccc217403b852420ff7c9a94.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
09614e70ccc217403b852420ff7c9a94.exe
Resource
win10v2004-20231215-en
General
-
Target
09614e70ccc217403b852420ff7c9a94.exe
-
Size
402KB
-
MD5
09614e70ccc217403b852420ff7c9a94
-
SHA1
e8a5691810a49873d4bdccf6776510a2db6c17d4
-
SHA256
a8e2a996c913eb390bd0074d461a97156ad7395ae5ca856c2a6e6c14be534e2d
-
SHA512
d51c22dd923b2733c60d8e185f64e45a34158119852e721bfdae80e893e8c1d779063bc2a84c2cb593bd05dcc64f1bf47da32bdd903eb8b5976c058d1995afc7
-
SSDEEP
6144:lw/1POelIqtW+YPjXbs0CsgEn4yr2BdjRbv2ixvD3OR6DF7DSeFr7knGyHM:lw/1PmPLssgETrA5Rl66VS+I
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3144 33A2E4F0.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe" 09614e70ccc217403b852420ff7c9a94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{7C046CF8-759C-4301-A95C-2D5FD8AD23DE} = "C:\\ProgramData\\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\\33A2E4F0.exe" 09614e70ccc217403b852420ff7c9a94.exe -
Program crash 11 IoCs
pid pid_target Process procid_target 3136 4536 WerFault.exe 85 552 3144 WerFault.exe 91 3160 3144 WerFault.exe 91 2472 3144 WerFault.exe 91 3676 3144 WerFault.exe 91 1648 3144 WerFault.exe 91 1844 3144 WerFault.exe 91 2176 3144 WerFault.exe 91 3684 3144 WerFault.exe 91 4300 3144 WerFault.exe 91 228 3144 WerFault.exe 91 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4536 wrote to memory of 3144 4536 09614e70ccc217403b852420ff7c9a94.exe 91 PID 4536 wrote to memory of 3144 4536 09614e70ccc217403b852420ff7c9a94.exe 91 PID 4536 wrote to memory of 3144 4536 09614e70ccc217403b852420ff7c9a94.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\09614e70ccc217403b852420ff7c9a94.exe"C:\Users\Admin\AppData\Local\Temp\09614e70ccc217403b852420ff7c9a94.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"C:\ProgramData\{1D7BD5EC-1EA9-44E8-9114-08DDFBD26AB9}\33A2E4F0.exe"2⤵
- Executes dropped EXE
PID:3144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 7483⤵
- Program crash
PID:552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 7563⤵
- Program crash
PID:3160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 7843⤵
- Program crash
PID:2472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 7643⤵
- Program crash
PID:3676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 7563⤵
- Program crash
PID:1648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 8323⤵
- Program crash
PID:1844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 8403⤵
- Program crash
PID:2176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 7563⤵
- Program crash
PID:3684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 8203⤵
- Program crash
PID:4300
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 7963⤵
- Program crash
PID:228
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 6402⤵
- Program crash
PID:3136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4536 -ip 45361⤵PID:4344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3144 -ip 31441⤵PID:3468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3144 -ip 31441⤵PID:2632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3144 -ip 31441⤵PID:1848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3144 -ip 31441⤵PID:1428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3144 -ip 31441⤵PID:792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3144 -ip 31441⤵PID:3632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3144 -ip 31441⤵PID:2116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3144 -ip 31441⤵PID:5080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3144 -ip 31441⤵PID:232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3144 -ip 31441⤵PID:4724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5c3cf8183baf6531801f0401fbf849ae7
SHA16dab5307d3b68f3530649ec56b7ae51f1c8b60f9
SHA2565691ae398da36bbb117cb0110776abb74b0c02be37558263da56cd0baa5b7d0d
SHA512382a1f3dffd1846c2dbdfd1491a0d77dff40ea38069eb53edd225eaafdd7972377eace8dae9911000d37c4918bb9da24e106ff6be333ef28f422583b3e1ab93a
-
Filesize
107KB
MD5a389d17d52e18d08f946145e1199187a
SHA1598d14ceaeb5c68bace49fb348b93e8353971270
SHA2564a99929a110dba4f21191c8bef3b23363e30f43b08d06b7c621a1a5a8a8424e8
SHA512cbfe88a2731c005027e7ba5fabe4162cb444ad613c587a1d50de54649c5ce6513366ea78a1b3ecc3ce7d93aab84bfc02e25b5e8399d3912c8c3d8c2deeed8262
-
Filesize
140B
MD57a6cbef7be65263118e3d87e1156df64
SHA143088af10901409b2d8f2235a1f3f0d900ac7046
SHA2560f63a150adc323fa90ed1a312250edb34def2e9b29ba7103de7e77c54c12f683
SHA512be22c7fd78c7dd4976cfac4515f127bf4eb8ff4e23a8fa8e3db89a76309646064578542d73a249420f1c11d69f394420525d1a0d4b209bf19cadb6283dd9d754