Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

39973a2c33...fb.exe

windows7-x64

6

39973a2c33...fb.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    168s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 14:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39973a2c33927b85cde6bbaab75d1bfb.exe

  • Size

    844KB

  • MD5

    39973a2c33927b85cde6bbaab75d1bfb

  • SHA1

    ac9e00e3f2936896075c68753327cd11a51e9762

  • SHA256

    2a3c749fee003fe59402fe41297441d6706225d3f9d2da7b45fc7b1dba870990

  • SHA512

    7f7057f8b19ade8360d93e997aa2a278a285b546f4cd0d5437606937f62eda6ac8998f7364de24a671ebbd6a210c07262fb9844cf8beb6a69af3b2db77851138

  • SSDEEP

    24576:vNifIxtvBagPtzPw7BRDkRD/2ik2+xcaqv15mBTarnh:gfIx1BaA547rD6+12yYvvmBe

Score
8/10
bootkitpersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 62 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\39973a2c33927b85cde6bbaab75d1bfb.exe
    "C:\Users\Admin\AppData\Local\Temp\39973a2c33927b85cde6bbaab75d1bfb.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 728
      2⤵
      • Program crash
      PID:2968
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 788
      2⤵
      • Program crash
      PID:736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1188
      2⤵
      • Program crash
      PID:5052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1272
      2⤵
      • Program crash
      PID:4108
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1280
      2⤵
      • Program crash
      PID:1944
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1380
      2⤵
      • Program crash
      PID:2616
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1396
      2⤵
      • Program crash
      PID:628
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1396
      2⤵
      • Program crash
      PID:3388
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1380
      2⤵
      • Program crash
      PID:4340
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1888
      2⤵
      • Program crash
      PID:2144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 1384
      2⤵
      • Program crash
      PID:2956
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2384 -ip 2384
    1⤵
      PID:920
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2384 -ip 2384
      1⤵
        PID:1280
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2384 -ip 2384
        1⤵
          PID:4288
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2384 -ip 2384
          1⤵
            PID:760
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2384 -ip 2384
            1⤵
              PID:872
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2384 -ip 2384
              1⤵
                PID:1032
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2384 -ip 2384
                1⤵
                  PID:3404
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2384 -ip 2384
                  1⤵
                    PID:1408
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2384 -ip 2384
                    1⤵
                      PID:5048
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:3100
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies Installed Components in the registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:3632
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:1788
                    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                      1⤵
                      • Modifies data under HKEY_USERS
                      • Suspicious use of SetWindowsHookEx
                      PID:5088
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Modifies registry class
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:988
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies registry class
                        PID:1060
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies Installed Components in the registry
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:904
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                      1⤵
                        PID:4044
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:3068
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          PID:4476
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                            PID:2172
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2064
                            • C:\Windows\explorer.exe
                              explorer.exe /LOADSAVEDWINDOWS
                              2⤵
                              • Modifies registry class
                              PID:2664
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                            • Modifies Installed Components in the registry
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:4092
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                            1⤵
                              PID:636
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              1⤵
                                PID:4456
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2384 -ip 2384
                                1⤵
                                  PID:116
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2384 -ip 2384
                                  1⤵
                                    PID:4428

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                    Filesize

                                    471B

                                    MD5

                                    5602e90c116a6e753f35080486765f70

                                    SHA1

                                    138eab99c4a8aa2550ef0504029d16ceb4f563f2

                                    SHA256

                                    cfdb79c520113b533729270407ff70f36d444ed61ead4b10791e5ce26c9ee088

                                    SHA512

                                    d4b50dcf2598585a0c1a269c53fd9ab8b6004fcb171713853a694b1a809e7c4c793f267710b662690f60b2a287ce8d23ba6dccd5fcff6ea02873c135ecc3a5d8

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                    Filesize

                                    412B

                                    MD5

                                    7303ec7558c997fb8bf69e1f0e16e5b9

                                    SHA1

                                    bccbeb94485475ec918df68c0958116841c0602d

                                    SHA256

                                    d1b2de03855276646df07ece314129ee71b4565aeb37f2e41a32fa530ecf65cc

                                    SHA512

                                    9f5f7e5c1ee26a378759853ef4b45ec64cc5d1a9a2387f6220f1114c665b2a038dd9663a8f0f94d800d405c1fcaa60ec194df97bd08ec1e3b950c13ec2a7628a

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                                    Filesize

                                    1022B

                                    MD5

                                    c04afde6daa12535b6f51d340bd02cfd

                                    SHA1

                                    aa13d49bd14f85e43b5fd27608efd90cbb1850c1

                                    SHA256

                                    945467ecbc13d00016f2602a3ec5b58c663dc3b3b42228a20e7ff81de43e9dcb

                                    SHA512

                                    d94508e727bd6e9a69e6be233bee87a1cc7497f0dff0858756c69a36f1a570384e6ceb5b89a2541e698ee0fd168c69c57d9ec4e3cc4d4903e6831f7d40925781

                                    Download Submit

                                  • memory/904-12-0x0000000004810000-0x0000000004811000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2384-26-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-28-0x0000000002980000-0x0000000002981000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2384-7-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-5-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-18-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-19-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-4-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-2-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-1-0x0000000002790000-0x0000000002791000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2384-40-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-0-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-6-0x0000000002980000-0x0000000002981000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2384-29-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-30-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-31-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-32-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-33-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-34-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-35-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-36-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-37-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-38-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/2384-39-0x0000000000400000-0x0000000000A37000-memory.dmp

                                    Filesize

                                    6.2MB

                                    Download

                                  • memory/4092-25-0x00000000048F0000-0x00000000048F1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download