Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 03:09
Static task
static1
Behavioral task
behavioral1
Sample
47dd4bd199f1685362ab94208fdf1c46.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
47dd4bd199f1685362ab94208fdf1c46.exe
Resource
win10v2004-20231215-en
General
-
Target
47dd4bd199f1685362ab94208fdf1c46.exe
-
Size
443KB
-
MD5
47dd4bd199f1685362ab94208fdf1c46
-
SHA1
a0d7842e93961334457db22f228f94ad748b2e73
-
SHA256
0169754271bd32b07ef6d3578c37a842e95d834cb50682e494c52eddd41caf8f
-
SHA512
9d2025bb67e6532f8eabd1bcf3882897685e6df7f11a20898df62b05da7fd62d889f6a42d0eebc148787a8ac3a4c9513faf52bdf7835f993fa1455aaf0f204f2
-
SSDEEP
6144:2bNacSdAG8sDKnsmJ7mBm/ZMVT5k/AtGRF2hjnXlJpWRnNXa2ea77kWWzxLFn/s5:XcSd1ismVO6+GRCX7K3kNzx9/s+vz3Ql
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3880-70-0x0000000000B50000-0x0000000000B80000-memory.dmp upx -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4920 sc.exe 1644 sc.exe -
Program crash 1 IoCs
pid pid_target Process 4564 3880 WerFault.exe -
Runs net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\47dd4bd199f1685362ab94208fdf1c46.exe"C:\Users\Admin\AppData\Local\Temp\47dd4bd199f1685362ab94208fdf1c46.exe"1⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\exrev.exe"C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\exrev.exe"2⤵PID:1740
-
-
C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\1EuroP.exe"C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\1EuroP.exe"2⤵PID:4200
-
-
C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\6tbp.exe"C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\6tbp.exe"2⤵PID:428
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\mseyRe.dll",Startup3⤵PID:1384
-
-
-
C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\IR.exe"C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\IR.exe"2⤵PID:1048
-
-
C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\3E4U - Bucks.exe"C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\3E4U - Bucks.exe"2⤵PID:3880
-
-
C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\2IC.exe"C:\Users\Admin\AppData\Local\Temp\nsa46B0.tmp\2IC.exe"2⤵PID:3684
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3880 -ip 38801⤵PID:776
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 5081⤵
- Program crash
PID:4564
-
C:\Windows\SysWOW64\Rundll32.exeRundll32.exe setupapi,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Roaming\mdinstall.inf1⤵PID:3064
-
C:\Windows\SysWOW64\runonce.exe"C:\Windows\system32\runonce.exe" -r2⤵PID:1588
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\System32\grpconv.exe" -o3⤵PID:3456
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\mesmfpwk.bat1⤵PID:2204
-
C:\Users\Admin\AppData\Roaming\jpposh.exeC:\Users\Admin\AppData\Roaming\jpposh.exe -d3C2FDC3602C532EDAB5A587F77335653F267A9D9573580495A360076DC0A8FE790EC6D70ABD726780470AC035967153D905342AA2D8614485A63C9B52857B7C5FBB28926424A9E72E1A0480FF70CECE6F1C6622E02B3FBFB71C31C74699D4EC826713527B9A7C878B97FBEE993501B4E5FE22C1F673C82B5B99BACE280FEB307F9EFB61F41030FC84776E5B6AE6A1D8C638E06062DD736088B106E318E5082659FFA91EC4A2C220C83D4D18B0895AF31C5AE94276644E451808D9916F5B1977F80FF8C9E85C9EE1EA6D6D842A435CF8C8E30BCF9612F98E47093A131559311C644F8ABA7E5579E2F2A2B8E1FC10BBAF9083DA38AB0C3A01475C53AB2906B4B20D63832989810A115C621C8F4E1A8EB2DBC1CAD94250A8912E7D05B13C66BE4DE5D11A85F1259A39E754B9CE3C5DB22CE71A7803ACF4D2011615237405821B7C5430DD1AB02E6922D6F7E5E136EAF5ABD333800400184718DBA13442EE80CE39B3257B3AE59479A312DFFA3FF1CCAD1B648E7533B4B18CAF90BF0382C56D6C47F113E9159493927D3691A41D252BE038F3B35DEE57D4EB8C2AF1C0676C3D9F6E30A6DF25B43E1E9A01A994D27CF14AD67D57746A5AAE708E33D18E49990A7588E862A9998F78FCAE27B141B9F95ECCD4E1EFB6F101⤵PID:1592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Windows Firewall/Internet Connection Sharing (ICS)"1⤵PID:4416
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Security Center"1⤵PID:2012
-
C:\Users\Admin\AppData\Roaming\jpposh.exeC:\Users\Admin\AppData\Roaming\jpposh.exe1⤵PID:2864
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= DISABLED1⤵
- Launches sc.exe
PID:4920
-
C:\Windows\SysWOW64\net.exenet.exe stop "Windows Firewall/Internet Connection Sharing (ICS)"1⤵PID:4360
-
C:\Windows\SysWOW64\sc.exesc config wscsvc start= DISABLED1⤵
- Launches sc.exe
PID:1644
-
C:\Windows\SysWOW64\net.exenet.exe stop "Security Center"1⤵PID:1784
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD57c0bd454f91d3626e9c056f743c7992d
SHA1942f936d5ab0f3175b5ea605765b272211c68bb6
SHA256cf990f0d542c54ecad711e5a4ccfe233f16791e2699db7e753e26346cecdb42c
SHA51207db4fd20e81a4cbe40d0b2e0debbe496aab61f10e38193f352ccbab8dfe98aad0c9d656192c1c55ba1295cd89ff5ed8fea27e646f6e6fbae98f02e9dec09eb8
-
Filesize
188KB
MD5ba547c42a869b0d4c163cd713d4799f0
SHA11655e5dd5d468d70711babba56c3a675b63039df
SHA25671184940ffed491a7ff3ab76672310e4fb9cd985988eb4e4ef8cf17d1cf6c781
SHA51220a4c249b3bcd845014102a958c8a8423d0072ec61edd68d21b12c2981b3f4b6c0afe69b238e1705c1352305745afb012968e8e6d121e02d1bc2e6e486a40b74
-
Filesize
27KB
MD55f6c6b5e491ac60e088adba6dd5791c2
SHA1292f4b81b3eee53877c672faf540aceeb2fc881f
SHA256b010d2d5cdee46b1b97b88aa48968ffd34f6e3e382b250c98f2e1a89c950e018
SHA51259c15d1a3f8d14eb441bb6e187cd91eaa13114afa1d8220aa7d08e259ee28af6bab92258b624d9824944b1776f916b6b551f3c3be982262d28b5330c7ba28252
-
Filesize
92KB
MD54765b5cd4ea278947f514e0c6bca9ea3
SHA11d0526904748ea5c7106b2eb0d0619d3c70cbae0
SHA2566208a24a8cca27d36cc7de195c1f13e4d316e94b0a10c30660fc58bc6948c250
SHA512ba67c082a59f1882c41e4e1ec1a41e48319ea9163037b258933f6cf31e583d90e3be54a9f0dbd66ec7e444a9f939c698657103cd985c4beb4c55602b0d065a42
-
Filesize
3KB
MD546e07fd3a40760fda18cf6b4fc691742
SHA153ee1a754bf5e94fa88a6ab8bb6120b4011afcfa
SHA256bd7ca609d2fb63e14d08acab1091579c23e298b4fa2ac1e8d2daaff94fc107be
SHA512ce13f6527cbd13002dca00b71ab38ab12e3f3f7138ada0780ad3f40e7c49946c018a00782ec957b1fd123fb439aabc0d9b3660829dabf10ddcebba08d6e2fbbd