Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 00:37

General

  • Target

    21f811f9863e63d2e1a7e9942eea40b8.exe

  • Size

    2.3MB

  • MD5

    21f811f9863e63d2e1a7e9942eea40b8

  • SHA1

    983ba2140521e049615e72c3e7d9d8702f214d83

  • SHA256

    0c1ddda0f5819ac85497de5400bcfb34474e3d7cd028d043525171cefef256b3

  • SHA512

    1ee9789aad428998d2e8c49b69ddf4e94eb6705a555947077fab1cfd56653af47cc726ff920a84b3dfebf6c1641191438b79e1829b156f95e7993acdd48f335c

  • SSDEEP

    49152:UM7DPU7Ku2ocLnbdq6alDLcWLDg3/UnCcxQO8NUQWWxwct1yTnlQT:UVN2DLilMheL5QWWxwct1I2

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 12 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe
    "C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 912
      2⤵
      • Program crash
      PID:3388
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1052
      2⤵
      • Program crash
      PID:2880
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1196
      2⤵
      • Program crash
      PID:4512
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1252
      2⤵
      • Program crash
      PID:4788
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1268
      2⤵
      • Program crash
      PID:5092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1272
      2⤵
      • Program crash
      PID:4256
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1332
      2⤵
      • Program crash
      PID:4408
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C ping 127.0.0.1 /n 300 & "C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe" 6
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3300
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 /n 300
        3⤵
        • Runs ping.exe
        PID:1696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1288
      2⤵
      • Program crash
      PID:652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1044
      2⤵
      • Program crash
      PID:4500
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C ping 127.0.0.1 -n 100 & "C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe" 5
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3600
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 100
        3⤵
        • Runs ping.exe
        PID:4104
      • C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe
        "C:\Users\Admin\AppData\Local\Temp\21f811f9863e63d2e1a7e9942eea40b8.exe" 5
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4124
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 912
          4⤵
          • Program crash
          PID:3296
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 152
          4⤵
          • Program crash
          PID:3596
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 1208
      2⤵
      • Program crash
      PID:1672
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1104 -ip 1104
    1⤵
      PID:1696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1104 -ip 1104
      1⤵
        PID:456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1104 -ip 1104
        1⤵
          PID:3236
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1104 -ip 1104
          1⤵
            PID:2920
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1104 -ip 1104
            1⤵
              PID:1508
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1104 -ip 1104
              1⤵
                PID:3376
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1104 -ip 1104
                1⤵
                  PID:4336
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1104 -ip 1104
                  1⤵
                    PID:4644
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1104 -ip 1104
                    1⤵
                      PID:4348
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1104 -ip 1104
                      1⤵
                        PID:3488
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4124 -ip 4124
                        1⤵
                          PID:4712
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4124 -ip 4124
                          1⤵
                            PID:212

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Temp\1704126504chrome.tmp

                            Filesize

                            3.5MB

                            MD5

                            a14b4e74c84560b88abc38f1a060aa23

                            SHA1

                            7b6066ad6e8e586350680e47f2dfaf720634ab4c

                            SHA256

                            34e30725a8973794b3ae255106552972302cabc30f58ea7a833bcc4cc616a52f

                            SHA512

                            e8a3ca50d6a9d0ea0411733aa27e7a5ee42bc993e8313076aa15e9df2d7d118a46627ecdd00579482c3a58e87d2ea85e003dd24c360655825721c71b5e881461

                          • memory/1104-0-0x0000000000400000-0x0000000001466000-memory.dmp

                            Filesize

                            16.4MB

                          • memory/1104-1-0x0000000000400000-0x0000000001466000-memory.dmp

                            Filesize

                            16.4MB

                          • memory/1104-2-0x0000000000400000-0x0000000001466000-memory.dmp

                            Filesize

                            16.4MB

                          • memory/1104-9-0x0000000000400000-0x0000000001466000-memory.dmp

                            Filesize

                            16.4MB

                          • memory/4124-12-0x0000000000400000-0x0000000001466000-memory.dmp

                            Filesize

                            16.4MB

                          • memory/4124-13-0x0000000000400000-0x0000000001466000-memory.dmp

                            Filesize

                            16.4MB