Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
50a456af5652c967f961a64cf3575cea.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
50a456af5652c967f961a64cf3575cea.exe
Resource
win10v2004-20231215-en
General
-
Target
50a456af5652c967f961a64cf3575cea.exe
-
Size
212KB
-
MD5
50a456af5652c967f961a64cf3575cea
-
SHA1
4d04414c7a3aa8ed11914983b9db386a784cb286
-
SHA256
e5e6dda576bbe9d03c05cef4f9858a772dd7fb183d62720ad694397ec33176eb
-
SHA512
217b2642f9d5d8a5af818c9d1e5805ba439c8ddeef467152ed99c5d62548fe5f229713842d3c72ea417c4f9cc58baac9368995ac0f2c6bec49280c8012904504
-
SSDEEP
3072:13TzXu32JVDHa94mHkIu8aauuuoQOzaKZEUHCRix3qO43F/oNO:13PXu3WITV9aaE0aKZhrxm/oNO
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 50a456af5652c967f961a64cf3575cea.exe -
Executes dropped EXE 1 IoCs
pid Process 3012 mwpwold.exe -
Loads dropped DLL 1 IoCs
pid Process 3012 mwpwold.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 15 IoCs
pid pid_target Process procid_target 4416 1508 WerFault.exe 88 2652 1508 WerFault.exe 88 5116 1508 WerFault.exe 88 4352 1508 WerFault.exe 88 3492 1508 WerFault.exe 88 4548 1508 WerFault.exe 88 4120 1508 WerFault.exe 88 3260 1508 WerFault.exe 88 2276 1508 WerFault.exe 88 2652 3012 WerFault.exe 128 224 3012 WerFault.exe 128 3464 3012 WerFault.exe 128 680 3012 WerFault.exe 128 4900 3012 WerFault.exe 128 3260 3012 WerFault.exe 128 -
Kills process with taskkill 1 IoCs
pid Process 3464 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2988 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3012 mwpwold.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3464 taskkill.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3012 mwpwold.exe 3012 mwpwold.exe 3012 mwpwold.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3012 mwpwold.exe 3012 mwpwold.exe 3012 mwpwold.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1508 wrote to memory of 5116 1508 50a456af5652c967f961a64cf3575cea.exe 121 PID 1508 wrote to memory of 5116 1508 50a456af5652c967f961a64cf3575cea.exe 121 PID 1508 wrote to memory of 5116 1508 50a456af5652c967f961a64cf3575cea.exe 121 PID 5116 wrote to memory of 3464 5116 cmd.exe 125 PID 5116 wrote to memory of 3464 5116 cmd.exe 125 PID 5116 wrote to memory of 3464 5116 cmd.exe 125 PID 5116 wrote to memory of 2988 5116 cmd.exe 126 PID 5116 wrote to memory of 2988 5116 cmd.exe 126 PID 5116 wrote to memory of 2988 5116 cmd.exe 126 PID 5116 wrote to memory of 3012 5116 cmd.exe 128 PID 5116 wrote to memory of 3012 5116 cmd.exe 128 PID 5116 wrote to memory of 3012 5116 cmd.exe 128
Processes
-
C:\Users\Admin\AppData\Local\Temp\50a456af5652c967f961a64cf3575cea.exe"C:\Users\Admin\AppData\Local\Temp\50a456af5652c967f961a64cf3575cea.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 6162⤵
- Program crash
PID:4416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 6402⤵
- Program crash
PID:2652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 8522⤵
- Program crash
PID:5116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 8602⤵
- Program crash
PID:4352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 9882⤵
- Program crash
PID:3492
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 10122⤵
- Program crash
PID:4548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 10002⤵
- Program crash
PID:4120
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 10402⤵
- Program crash
PID:3260
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1508 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\50a456af5652c967f961a64cf3575cea.exe" & start C:\Users\Admin\AppData\Local\mwpwold.exe -f2⤵
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 15083⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:2988
-
-
C:\Users\Admin\AppData\Local\mwpwold.exeC:\Users\Admin\AppData\Local\mwpwold.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 8884⤵
- Program crash
PID:2652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 8804⤵
- Program crash
PID:224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 11844⤵
- Program crash
PID:3464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 11924⤵
- Program crash
PID:680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 12324⤵
- Program crash
PID:4900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 12204⤵
- Program crash
PID:3260
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 1602⤵
- Program crash
PID:2276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1508 -ip 15081⤵PID:1896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1508 -ip 15081⤵PID:624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1508 -ip 15081⤵PID:2860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1508 -ip 15081⤵PID:3912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1508 -ip 15081⤵PID:2844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1508 -ip 15081⤵PID:1248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1508 -ip 15081⤵PID:4272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1508 -ip 15081⤵PID:4384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1508 -ip 15081⤵PID:4536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3012 -ip 30121⤵PID:4948
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3012 -ip 30121⤵PID:4944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3012 -ip 30121⤵PID:700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3012 -ip 30121⤵PID:1480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3012 -ip 30121⤵PID:1328
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3012 -ip 30121⤵PID:4948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD550a456af5652c967f961a64cf3575cea
SHA14d04414c7a3aa8ed11914983b9db386a784cb286
SHA256e5e6dda576bbe9d03c05cef4f9858a772dd7fb183d62720ad694397ec33176eb
SHA512217b2642f9d5d8a5af818c9d1e5805ba439c8ddeef467152ed99c5d62548fe5f229713842d3c72ea417c4f9cc58baac9368995ac0f2c6bec49280c8012904504