Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
3cd4736e078626a00f2c36d6e5f09a1c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3cd4736e078626a00f2c36d6e5f09a1c.exe
Resource
win10v2004-20231215-en
General
-
Target
3cd4736e078626a00f2c36d6e5f09a1c.exe
-
Size
556KB
-
MD5
3cd4736e078626a00f2c36d6e5f09a1c
-
SHA1
f7fddc294a13c78d12730dd1f4ee8c49055d1379
-
SHA256
3a7be50f09bf3dd2a494aae3c79c938cfb70c77b348dab82737f8d783e49193a
-
SHA512
e80e12af806220aed99a0dfa17d76ed35f05f174fe9e9b3ce5500fb80b0fa3379e507af133e644cf122397e1c83b76535d010ce7bfe005fb810dd66528e23e3e
-
SSDEEP
12288:07Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:07L1yMgcnOds44Fp2PWUDI8
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3380-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-59-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3140-63-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2064-68-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2064-70-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/2064-74-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/3140-67-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2344-64-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/2064-62-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral2/memory/3140-58-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral2/memory/2344-57-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/2344-52-0x0000000000400000-0x0000000000455000-memory.dmp upx behavioral2/memory/3380-49-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 -
Program crash 1 IoCs
pid pid_target Process 3176 912 WerFault.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1232 tasklist.exe 1864 tasklist.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 976 3cd4736e078626a00f2c36d6e5f09a1c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe"C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:976 -
C:\Users\Admin\NB4wr66jY4.exeC:\Users\Admin\NB4wr66jY4.exe2⤵PID:1508
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe3⤵PID:2488
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
PID:1232
-
-
-
C:\Users\Admin\biiew.exe"C:\Users\Admin\biiew.exe"3⤵PID:4092
-
-
-
C:\Users\Admin\3xek.exeC:\Users\Admin\3xek.exe2⤵PID:4608
-
C:\Users\Admin\AppData\Local\798294ad\X*0*bc*4e809dd8*31.193.3.240:533⤵PID:2956
-
-
-
C:\Users\Admin\2xek.exeC:\Users\Admin\2xek.exe2⤵PID:396
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 3cd4736e078626a00f2c36d6e5f09a1c.exe2⤵PID:4540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 801⤵
- Program crash
PID:3176
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"1⤵PID:2064
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"1⤵PID:3140
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"1⤵PID:2344
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"1⤵PID:3380
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 912 -ip 9121⤵PID:1636
-
C:\Users\Admin\2xek.exe"C:\Users\Admin\2xek.exe"1⤵PID:912
-
C:\Windows\SysWOW64\tasklist.exetasklist1⤵
- Enumerates processes with tasklist
PID:1864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5eb290c307670d7c14ad917ba640fe0e0
SHA1d17751b25fb749c691715409efd3a4bcc517a896
SHA25612365f9a85a25a59e8c9f855b40e88559cb5239141d5db6394befcaadfdb6830
SHA5120864597cc0f9ef66db090370803f5bebe041a43cf527470e0612ce4e278dab25d9e5db1c98d81748b87c852d21bf7bf9f3f7176795b33091beffe2726306b7aa
-
Filesize
94KB
MD53619ceed09f67f1ce5460e0911448c09
SHA1d74881611205f0a90052851a46b0de7aaf36e414
SHA256a1d327d4d175d92425dca894a45c71e730b0c47cc5f3b2590db5c198196dde45
SHA5122efc433e1dce82995814ce4bedc931a709a0f0da2e007fdc4ab7b85b423bc20946fca915697acf071ebb2cc43f84f6786fd52c8fe77fa5d145be00f8c442682e