Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

ed26b17370...50.exe

windows7-x64

8

ed26b17370...50.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 04:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe

  • Size

    779KB

  • MD5

    002bff6573f0e7721b37dbbaebb75d47

  • SHA1

    2aea4be00024a7e4aaa2454728e10896b48bd086

  • SHA256

    ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50

  • SHA512

    a808744182d23640b1d944a795597cab11419c8e62646709ea4e3338de82af3c559272e28c93dc6bcc2eb6b116197dc755b3c62b5730567aff019619798a20d5

  • SSDEEP

    12288:xPJTcmjRN6KSYqk5lvgKTgt9awhBcxet8mBVRTqeRKwpNtW4fo:lJ4m9iyv28whSwRBVRTwwpK

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe
    "C:\Users\Admin\AppData\Local\Temp\ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:980
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 356
      2⤵
      • Program crash
      PID:1564
    • C:\Users\Admin\AppData\Local\Temp\ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe
      C:\Users\Admin\AppData\Local\Temp\ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • System policy modification
      PID:2072
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 324
        3⤵
        • Program crash
        PID:2240
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 668
        3⤵
        • Program crash
        PID:3568
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 800
        3⤵
        • Program crash
        PID:4752
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 840
        3⤵
        • Program crash
        PID:2272
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 816
        3⤵
        • Program crash
        PID:3372
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 816
        3⤵
        • Program crash
        PID:2660
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 1064
        3⤵
        • Program crash
        PID:3692
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2072 -s 1292
        3⤵
        • Program crash
        PID:2208
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 980 -ip 980
    1⤵
      PID:2520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2072 -ip 2072
      1⤵
        PID:3764
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2072 -ip 2072
        1⤵
          PID:4956
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2072 -ip 2072
          1⤵
            PID:5060
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2072 -ip 2072
            1⤵
              PID:4968
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2072 -ip 2072
              1⤵
                PID:3412
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2072 -ip 2072
                1⤵
                  PID:4580
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2072 -ip 2072
                  1⤵
                    PID:368
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2072 -ip 2072
                    1⤵
                      PID:1500
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:3488
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies registry class
                        PID:1068
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Modifies Installed Components in the registry
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:2008
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                      1⤵
                      • Suspicious behavior: AddClipboardFormatListener
                      PID:3164
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                      1⤵
                        PID:2764
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Suspicious use of SetWindowsHookEx
                        PID:1408
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:4132
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                        1⤵
                          PID:4788
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:3468
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:3332
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:2044
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:2208
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:3820

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\173XOV43\microsoft.windows[1].xml
                          Filesize

                          97B

                          MD5

                          69218a4104d98cc60771adb1196cdc00

                          SHA1

                          4f246fa40fdc113a981baf6878b76105315f4716

                          SHA256

                          eae1b6694a6a0ede1fec00de1f4c50c73d39083ef584b85c6ee2c2a9275ee0cc

                          SHA512

                          80ba7bbfc84da3941d571a526c8c94ee7d4b31744279137d4f38b55d84c682647c3ce57652e7729e03ce1a2562b416be79687024a51a3d01161db808790d5ae4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\ed26b1737037537b3e4c74b5a66c5f3c53ca7000a6582b086140f1254a6d1d50.exe
                          Filesize

                          779KB

                          MD5

                          85e95479d58df22003b1348c99eb571b

                          SHA1

                          7079c23a571a0397b1391e4b8ffea8b828267cb9

                          SHA256

                          e769b02bd18561016b0f465aac59a4ab844ff6b5a4e1af99c046a59e3cbfff35

                          SHA512

                          c306995246ab834184f2670a5577a0a6e3768eeb84506847086a3e8f73b2106c9c12e269aca3963ded370f7db529971f287a70476d9be85c0932facd4925305b

                          Download Submit

                        • memory/980-7-0x0000000000400000-0x000000000047C000-memory.dmp

                          Filesize

                          496KB

                          Download

                        • memory/980-0-0x0000000000400000-0x000000000047C000-memory.dmp

                          Filesize

                          496KB

                          Download

                        • memory/2008-26-0x0000000004030000-0x0000000004031000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2044-102-0x000001D788C50000-0x000001D788C70000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/2044-100-0x000001D788640000-0x000001D788660000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/2044-97-0x000001D788680000-0x000001D7886A0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/2072-24-0x0000000000400000-0x000000000045A000-memory.dmp

                          Filesize

                          360KB

                          Download

                        • memory/2072-9-0x0000000000400000-0x000000000045A000-memory.dmp

                          Filesize

                          360KB

                          Download

                        • memory/2072-16-0x0000000000400000-0x000000000045A000-memory.dmp

                          Filesize

                          360KB

                          Download

                        • memory/2072-6-0x0000000000400000-0x000000000047C000-memory.dmp

                          Filesize

                          496KB

                          Download

                        • memory/2072-8-0x0000000004EF0000-0x0000000004F6C000-memory.dmp

                          Filesize

                          496KB

                          Download

                        • memory/2208-122-0x0000029DBCC80000-0x0000029DBCCA0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/2208-120-0x0000029DBC870000-0x0000029DBC890000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/2208-118-0x0000029DBC8B0000-0x0000029DBC8D0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3332-79-0x000001AB75D60000-0x000001AB75D80000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3332-84-0x000001AB76120000-0x000001AB76140000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3332-81-0x000001AB75D20000-0x000001AB75D40000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3468-65-0x0000022F95940000-0x0000022F95960000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3468-61-0x0000022F952B0000-0x0000022F952D0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3468-58-0x0000022F95330000-0x0000022F95350000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3820-139-0x0000022E4EE60000-0x0000022E4EE80000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3820-142-0x0000022E4EE20000-0x0000022E4EE40000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3820-146-0x0000022E4F230000-0x0000022E4F250000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/4132-35-0x0000013D73A70000-0x0000013D73A90000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/4132-42-0x0000013D73E40000-0x0000013D73E60000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/4132-38-0x0000013D73A30000-0x0000013D73A50000-memory.dmp

                          Filesize

                          128KB

                          Download