Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 09:27
Behavioral task
behavioral1
Sample
4df392aaa1d685e96cdc2cfbd98b75eb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4df392aaa1d685e96cdc2cfbd98b75eb.exe
Resource
win10v2004-20231215-en
General
-
Target
4df392aaa1d685e96cdc2cfbd98b75eb.exe
-
Size
3.9MB
-
MD5
4df392aaa1d685e96cdc2cfbd98b75eb
-
SHA1
4f5f91388dc11eac90e8d288b82ee51b007c41f6
-
SHA256
19679cbc4b7cd73fd4501ed735c351aaf8335f2adbf8a1d25965e87b683cd5bd
-
SHA512
b2f10bfc9597f4c4885496a1c8d9b6e0e826ee4c3461830601b45a7b595c9722edfd2436d101d10bb202bc2fd4e720422a903c8d631223b79d08c7c2dd6f16dd
-
SSDEEP
98304:2QXkDgpaCcakcibiqhGccFd3ucakcibiqh0V314pLG9cakcibiqhGccFd3ucakcO:2RgpxdlirRM5udlirqVl4g9dlirRM5u+
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 5024 4df392aaa1d685e96cdc2cfbd98b75eb.exe -
Executes dropped EXE 1 IoCs
pid Process 5024 4df392aaa1d685e96cdc2cfbd98b75eb.exe -
resource yara_rule behavioral2/memory/816-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral2/memory/5024-14-0x0000000000400000-0x000000000065C000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 18 IoCs
pid pid_target Process procid_target 1952 5024 WerFault.exe 2284 5024 WerFault.exe 1992 5024 WerFault.exe 1228 5024 WerFault.exe 2908 5024 WerFault.exe 33 3204 5024 WerFault.exe 33 1040 5024 WerFault.exe 33 2120 5024 WerFault.exe 33 4776 5024 WerFault.exe 33 2668 5024 WerFault.exe 33 4708 5024 WerFault.exe 33 2748 5024 WerFault.exe 33 1140 5024 WerFault.exe 33 4320 5024 WerFault.exe 33 1476 5024 WerFault.exe 33 3964 5024 WerFault.exe 33 2668 5024 WerFault.exe 33 540 5024 WerFault.exe 33 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5112 schtasks.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 816 4df392aaa1d685e96cdc2cfbd98b75eb.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 816 4df392aaa1d685e96cdc2cfbd98b75eb.exe 5024 4df392aaa1d685e96cdc2cfbd98b75eb.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 816 wrote to memory of 5024 816 4df392aaa1d685e96cdc2cfbd98b75eb.exe 33 PID 816 wrote to memory of 5024 816 4df392aaa1d685e96cdc2cfbd98b75eb.exe 33 PID 816 wrote to memory of 5024 816 4df392aaa1d685e96cdc2cfbd98b75eb.exe 33 PID 5024 wrote to memory of 5112 5024 4df392aaa1d685e96cdc2cfbd98b75eb.exe 25 PID 5024 wrote to memory of 5112 5024 4df392aaa1d685e96cdc2cfbd98b75eb.exe 25 PID 5024 wrote to memory of 5112 5024 4df392aaa1d685e96cdc2cfbd98b75eb.exe 25 PID 5024 wrote to memory of 1052 5024 4df392aaa1d685e96cdc2cfbd98b75eb.exe 24 PID 5024 wrote to memory of 1052 5024 4df392aaa1d685e96cdc2cfbd98b75eb.exe 24 PID 5024 wrote to memory of 1052 5024 4df392aaa1d685e96cdc2cfbd98b75eb.exe 24 PID 1052 wrote to memory of 1300 1052 cmd.exe 19 PID 1052 wrote to memory of 1300 1052 cmd.exe 19 PID 1052 wrote to memory of 1300 1052 cmd.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\4df392aaa1d685e96cdc2cfbd98b75eb.exe"C:\Users\Admin\AppData\Local\Temp\4df392aaa1d685e96cdc2cfbd98b75eb.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\4df392aaa1d685e96cdc2cfbd98b75eb.exeC:\Users\Admin\AppData\Local\Temp\4df392aaa1d685e96cdc2cfbd98b75eb.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 7243⤵
- Program crash
PID:2908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 7563⤵
- Program crash
PID:3204
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 14643⤵
- Program crash
PID:1040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 19163⤵
- Program crash
PID:2120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 21443⤵
- Program crash
PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 21483⤵
- Program crash
PID:2668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 19563⤵
- Program crash
PID:4708
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 21443⤵
- Program crash
PID:2748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 19723⤵
- Program crash
PID:1140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 19043⤵
- Program crash
PID:4320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 21043⤵
- Program crash
PID:1476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 21683⤵
- Program crash
PID:3964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 19843⤵
- Program crash
PID:2668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 6323⤵
- Program crash
PID:540
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN nMQUF5AE494a1⤵PID:1300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5024 -ip 50241⤵PID:4692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 6041⤵
- Program crash
PID:1952
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN nMQUF5AE494a > C:\Users\Admin\AppData\Local\Temp\QDI4MHx.xml1⤵
- Suspicious use of WriteProcessMemory
PID:1052
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\4df392aaa1d685e96cdc2cfbd98b75eb.exe" /TN nMQUF5AE494a /F1⤵
- Creates scheduled task(s)
PID:5112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5024 -ip 50241⤵PID:5032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 6201⤵
- Program crash
PID:2284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5024 -ip 50241⤵PID:2072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 7361⤵
- Program crash
PID:1992
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5024 -ip 50241⤵PID:1408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 7401⤵
- Program crash
PID:1228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5024 -ip 50241⤵PID:2764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5024 -ip 50241⤵PID:2032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5024 -ip 50241⤵PID:1364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5024 -ip 50241⤵PID:4916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5024 -ip 50241⤵PID:4808
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5024 -ip 50241⤵PID:2356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5024 -ip 50241⤵PID:4084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5024 -ip 50241⤵PID:4472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5024 -ip 50241⤵PID:316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5024 -ip 50241⤵PID:4580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5024 -ip 50241⤵PID:3480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5024 -ip 50241⤵PID:2060
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5024 -ip 50241⤵PID:3448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5024 -ip 50241⤵PID:4548