Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 03:14

General

  • Target

    7bfef7415062c3d9867dfb56c17d48d4.exe

  • Size

    3.9MB

  • MD5

    7bfef7415062c3d9867dfb56c17d48d4

  • SHA1

    2081d58ce2417a3a4c1592dda95d1c99074c4b90

  • SHA256

    75e146f2dac8657bb26e6b38830c63b247e9f2f0cace0a2d787d9199ff36c204

  • SHA512

    8b38c0ca7673e0248b5c4d85eb94d3621c581d71a9147c0bc157e54039541c92de8248042787e775b451de20c260936f0cbc2da4dfdaf50b2bee4f24f7a69334

  • SSDEEP

    98304:w0HGp6FXzJ5WgacakcibiqhMbMgOn7n0bcakcibiqh+CP4acakcibiqhMbMgOn7R:w0HGp6zkgadlirybMgOnkdliryadlirV

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Program crash 18 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7bfef7415062c3d9867dfb56c17d48d4.exe
    "C:\Users\Admin\AppData\Local\Temp\7bfef7415062c3d9867dfb56c17d48d4.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Users\Admin\AppData\Local\Temp\7bfef7415062c3d9867dfb56c17d48d4.exe
      C:\Users\Admin\AppData\Local\Temp\7bfef7415062c3d9867dfb56c17d48d4.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\7bfef7415062c3d9867dfb56c17d48d4.exe" /TN EftJtVnu5bdb /F
        3⤵
        • Creates scheduled task(s)
        PID:3464
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN EftJtVnu5bdb > C:\Users\Admin\AppData\Local\Temp\eTZlLn.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4984
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN EftJtVnu5bdb
          4⤵
            PID:4964
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 604
          3⤵
          • Program crash
          PID:4976
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 624
          3⤵
          • Program crash
          PID:3220
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 724
          3⤵
          • Program crash
          PID:2456
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 632
          3⤵
          • Program crash
          PID:4556
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 724
          3⤵
          • Program crash
          PID:2424
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 820
          3⤵
          • Program crash
          PID:5036
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1468
          3⤵
          • Program crash
          PID:4756
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1924
          3⤵
          • Program crash
          PID:1056
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 2144
          3⤵
          • Program crash
          PID:2940
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1884
          3⤵
          • Program crash
          PID:1772
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1876
          3⤵
          • Program crash
          PID:3348
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1984
          3⤵
          • Program crash
          PID:1908
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 2000
          3⤵
          • Program crash
          PID:3412
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 2148
          3⤵
          • Program crash
          PID:3832
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 2176
          3⤵
          • Program crash
          PID:3192
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1984
          3⤵
          • Program crash
          PID:1184
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 2196
          3⤵
          • Program crash
          PID:5088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 756
          3⤵
          • Program crash
          PID:4532
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3552 -ip 3552
      1⤵
        PID:4048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3552 -ip 3552
        1⤵
          PID:1208
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3552 -ip 3552
          1⤵
            PID:2820
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3552 -ip 3552
            1⤵
              PID:2360
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3552 -ip 3552
              1⤵
                PID:3164
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3552 -ip 3552
                1⤵
                  PID:4656
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3552 -ip 3552
                  1⤵
                    PID:2928
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3552 -ip 3552
                    1⤵
                      PID:4972
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3552 -ip 3552
                      1⤵
                        PID:1032
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3552 -ip 3552
                        1⤵
                          PID:3244
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3552 -ip 3552
                          1⤵
                            PID:3876
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3552 -ip 3552
                            1⤵
                              PID:3404
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3552 -ip 3552
                              1⤵
                                PID:4660
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3552 -ip 3552
                                1⤵
                                  PID:4424
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3552 -ip 3552
                                  1⤵
                                    PID:2964
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3552 -ip 3552
                                    1⤵
                                      PID:1456
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3552 -ip 3552
                                      1⤵
                                        PID:4920
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3552 -ip 3552
                                        1⤵
                                          PID:4620

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\7bfef7415062c3d9867dfb56c17d48d4.exe

                                          Filesize

                                          3.9MB

                                          MD5

                                          d140dfa0c2840221bc3c20e706635be5

                                          SHA1

                                          56c18337e875cdff387e39d393b1cfa883d3c1a8

                                          SHA256

                                          f165c6a2e947501095bc445f03ada24c4175477707dbf4d432ab989dd518e5aa

                                          SHA512

                                          883c2d52fa93f335a1915d94a347331f818f1a94693b263499497990f29429bbae41a97e02f6c1e7d8edba39afa684817384142ea795fb6f66d972f4e51fccd2

                                        • C:\Users\Admin\AppData\Local\Temp\eTZlLn.xml

                                          Filesize

                                          1KB

                                          MD5

                                          9f9ad391ccc58c93427b5f5a1f44b8a8

                                          SHA1

                                          9d5b85fae7152a6c2cb47de7bc42ce9741963f6a

                                          SHA256

                                          68c32405fc76c243d6f14a7addbd4953052daf559a3c02209c9ee8e60345b434

                                          SHA512

                                          8815e56dbcd2a76c568daaa28af7f6b1b9834035fcac163ba230a6110ebe8dce32fa2f5024ca8347b1e4893b0d0b97f469e7f07864268a0323affb29a6362c09

                                        • memory/3552-14-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB

                                        • memory/3552-17-0x0000000025010000-0x000000002508E000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/3552-22-0x0000000000470000-0x00000000004DB000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/3552-23-0x0000000000400000-0x000000000045B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/3552-40-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB

                                        • memory/4596-0-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB

                                        • memory/4596-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/4596-5-0x0000000001730000-0x00000000017AE000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/4596-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                          Filesize

                                          428KB