Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 10:23

General

  • Target

    3cd4736e078626a00f2c36d6e5f09a1c.exe

  • Size

    556KB

  • MD5

    3cd4736e078626a00f2c36d6e5f09a1c

  • SHA1

    f7fddc294a13c78d12730dd1f4ee8c49055d1379

  • SHA256

    3a7be50f09bf3dd2a494aae3c79c938cfb70c77b348dab82737f8d783e49193a

  • SHA512

    e80e12af806220aed99a0dfa17d76ed35f05f174fe9e9b3ce5500fb80b0fa3379e507af133e644cf122397e1c83b76535d010ce7bfe005fb810dd66528e23e3e

  • SSDEEP

    12288:07Lo8Rs90X41cnOOWB2KpyYK4BVqZDx2mpmHPW9GROsI8w:07L1yMgcnOds44Fp2PWUDI8

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Program crash 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe
    "C:\Users\Admin\AppData\Local\Temp\3cd4736e078626a00f2c36d6e5f09a1c.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:976
    • C:\Users\Admin\NB4wr66jY4.exe
      C:\Users\Admin\NB4wr66jY4.exe
      2⤵
        PID:1508
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del NB4wr66jY4.exe
          3⤵
            PID:2488
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              PID:1232
          • C:\Users\Admin\biiew.exe
            "C:\Users\Admin\biiew.exe"
            3⤵
              PID:4092
          • C:\Users\Admin\3xek.exe
            C:\Users\Admin\3xek.exe
            2⤵
              PID:4608
              • C:\Users\Admin\AppData\Local\798294ad\X
                *0*bc*4e809dd8*31.193.3.240:53
                3⤵
                  PID:2956
              • C:\Users\Admin\2xek.exe
                C:\Users\Admin\2xek.exe
                2⤵
                  PID:396
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c tasklist&&del 3cd4736e078626a00f2c36d6e5f09a1c.exe
                  2⤵
                    PID:4540
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 80
                  1⤵
                  • Program crash
                  PID:3176
                • C:\Users\Admin\2xek.exe
                  "C:\Users\Admin\2xek.exe"
                  1⤵
                    PID:2064
                  • C:\Users\Admin\2xek.exe
                    "C:\Users\Admin\2xek.exe"
                    1⤵
                      PID:3140
                    • C:\Users\Admin\2xek.exe
                      "C:\Users\Admin\2xek.exe"
                      1⤵
                        PID:2344
                      • C:\Users\Admin\2xek.exe
                        "C:\Users\Admin\2xek.exe"
                        1⤵
                          PID:3380
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 912 -ip 912
                          1⤵
                            PID:1636
                          • C:\Users\Admin\2xek.exe
                            "C:\Users\Admin\2xek.exe"
                            1⤵
                              PID:912
                            • C:\Windows\SysWOW64\tasklist.exe
                              tasklist
                              1⤵
                              • Enumerates processes with tasklist
                              PID:1864

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\NB4wr66jY4.exe

                              Filesize

                              94KB

                              MD5

                              eb290c307670d7c14ad917ba640fe0e0

                              SHA1

                              d17751b25fb749c691715409efd3a4bcc517a896

                              SHA256

                              12365f9a85a25a59e8c9f855b40e88559cb5239141d5db6394befcaadfdb6830

                              SHA512

                              0864597cc0f9ef66db090370803f5bebe041a43cf527470e0612ce4e278dab25d9e5db1c98d81748b87c852d21bf7bf9f3f7176795b33091beffe2726306b7aa

                            • C:\Users\Admin\biiew.exe

                              Filesize

                              94KB

                              MD5

                              3619ceed09f67f1ce5460e0911448c09

                              SHA1

                              d74881611205f0a90052851a46b0de7aaf36e414

                              SHA256

                              a1d327d4d175d92425dca894a45c71e730b0c47cc5f3b2590db5c198196dde45

                              SHA512

                              2efc433e1dce82995814ce4bedc931a709a0f0da2e007fdc4ab7b85b423bc20946fca915697acf071ebb2cc43f84f6786fd52c8fe77fa5d145be00f8c442682e

                            • memory/2064-70-0x0000000000400000-0x000000000040A000-memory.dmp

                              Filesize

                              40KB

                            • memory/2064-62-0x0000000000400000-0x000000000040A000-memory.dmp

                              Filesize

                              40KB

                            • memory/2064-74-0x0000000000400000-0x000000000040A000-memory.dmp

                              Filesize

                              40KB

                            • memory/2064-68-0x0000000000400000-0x000000000040A000-memory.dmp

                              Filesize

                              40KB

                            • memory/2344-57-0x0000000000400000-0x0000000000455000-memory.dmp

                              Filesize

                              340KB

                            • memory/2344-64-0x0000000000400000-0x0000000000455000-memory.dmp

                              Filesize

                              340KB

                            • memory/2344-91-0x0000000000400000-0x0000000000455000-memory.dmp

                              Filesize

                              340KB

                            • memory/2344-59-0x0000000000400000-0x0000000000455000-memory.dmp

                              Filesize

                              340KB

                            • memory/2344-52-0x0000000000400000-0x0000000000455000-memory.dmp

                              Filesize

                              340KB

                            • memory/3140-63-0x0000000000400000-0x0000000000407000-memory.dmp

                              Filesize

                              28KB

                            • memory/3140-67-0x0000000000400000-0x0000000000407000-memory.dmp

                              Filesize

                              28KB

                            • memory/3140-58-0x0000000000400000-0x0000000000407000-memory.dmp

                              Filesize

                              28KB

                            • memory/3140-92-0x0000000000400000-0x0000000000407000-memory.dmp

                              Filesize

                              28KB

                            • memory/3380-90-0x0000000000400000-0x0000000000429000-memory.dmp

                              Filesize

                              164KB

                            • memory/3380-49-0x0000000000400000-0x0000000000429000-memory.dmp

                              Filesize

                              164KB

                            • memory/3380-56-0x0000000000400000-0x0000000000429000-memory.dmp

                              Filesize

                              164KB

                            • memory/3380-53-0x0000000000400000-0x0000000000429000-memory.dmp

                              Filesize

                              164KB

                            • memory/3408-88-0x0000000002540000-0x0000000002548000-memory.dmp

                              Filesize

                              32KB

                            • memory/4608-89-0x0000000030670000-0x00000000306C7000-memory.dmp

                              Filesize

                              348KB

                            • memory/4608-81-0x0000000030670000-0x00000000306C7000-memory.dmp

                              Filesize

                              348KB

                            • memory/4608-82-0x0000000000610000-0x0000000000710000-memory.dmp

                              Filesize

                              1024KB