Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 16:45

General

  • Target

    fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe

  • Size

    44.1MB

  • MD5

    71ba5156246b9df86f7ce5232d10379a

  • SHA1

    78255379df33cdfe5fd3245b18edc0f14f77bd96

  • SHA256

    fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e

  • SHA512

    cbe0d08397825bca7c303bf3336cae9396c511e4f963703d572322f892df3149b3b10e6c57e656dd14cb52db8760360bd36b3a6292e8f2a6747f5f532b6dc8f7

  • SSDEEP

    786432:3rMzfSAY24BjG2JnLns5oTgztADHw1zsgoTYpu1ME79NO8Lzv0eO5gpHG+vHhqEg:IzfZTyVnLTT7HweQqNBO+GtIKl

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe
    "C:\Users\Admin\AppData\Local\Temp\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Users\Admin\AppData\Local\Temp\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe
      "C:\Users\Admin\AppData\Local\Temp\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe" --crash-reporter-parent-id=2496
      2⤵
      • Loads dropped DLL
      PID:1132
    • C:\Users\Admin\AppData\Local\Temp\Opera Installer\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe
      "C:\Users\Admin\AppData\Local\Temp\Opera Installer\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe" --version
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Opera Installer\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe

    Filesize

    2.7MB

    MD5

    27c06dcb55356f3a0b29adf2d8c081da

    SHA1

    da28d6d3559a17322c78ac020175191115d0ba8c

    SHA256

    a7b5fdd9c74942521e40ac592f8ed9ff51ba93033d175389841ff50b06c80a75

    SHA512

    cf7463cecf1737267710ea35a144bd077dea0ea2b7f8663a70bd4f6129562505e8f65195ff407175e32b849af52197b4f3277450861efafb772aac93b1ba5c36

  • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2024225463246.dll

    Filesize

    1.5MB

    MD5

    6775542a38c0cc65efee6cf8d346b384

    SHA1

    c91ca7e67d69c949fedba14d72fd9cf96459359a

    SHA256

    146320f8bbff9e56aeee7b87a22ead991bd4cce94953a49288b0a2b07569f3d9

    SHA512

    94d86e857b5e6fd9dad969ba77d31aa8cfa0714d23f1daafa7c380c3eeaf3283d3e9968786b65da8e4891fd23721e399e3217186ed31cda0688697b287b78f71

  • memory/2496-6-0x0000000002A40000-0x0000000002A47000-memory.dmp

    Filesize

    28KB

  • memory/2496-7-0x0000000002A40000-0x0000000002A47000-memory.dmp

    Filesize

    28KB

  • memory/2496-8-0x0000000002A40000-0x0000000002A47000-memory.dmp

    Filesize

    28KB