Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 16:45
Static task
static1
Behavioral task
behavioral1
Sample
fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe
Resource
win10v2004-20240221-en
General
-
Target
fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe
-
Size
44.1MB
-
MD5
71ba5156246b9df86f7ce5232d10379a
-
SHA1
78255379df33cdfe5fd3245b18edc0f14f77bd96
-
SHA256
fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e
-
SHA512
cbe0d08397825bca7c303bf3336cae9396c511e4f963703d572322f892df3149b3b10e6c57e656dd14cb52db8760360bd36b3a6292e8f2a6747f5f532b6dc8f7
-
SSDEEP
786432:3rMzfSAY24BjG2JnLns5oTgztADHw1zsgoTYpu1ME79NO8Lzv0eO5gpHG+vHhqEg:IzfZTyVnLTT7HweQqNBO+GtIKl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 5036 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe -
Loads dropped DLL 3 IoCs
pid Process 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 1132 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 5036 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe File opened (read-only) \??\F: fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Opera fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2496 wrote to memory of 1132 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 89 PID 2496 wrote to memory of 1132 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 89 PID 2496 wrote to memory of 1132 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 89 PID 2496 wrote to memory of 5036 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 90 PID 2496 wrote to memory of 5036 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 90 PID 2496 wrote to memory of 5036 2496 fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe"C:\Users\Admin\AppData\Local\Temp\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe"C:\Users\Admin\AppData\Local\Temp\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe" --crash-reporter-parent-id=24962⤵
- Loads dropped DLL
PID:1132
-
-
C:\Users\Admin\AppData\Local\Temp\Opera Installer\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe"C:\Users\Admin\AppData\Local\Temp\Opera Installer\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe" --version2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Opera Installer\fada2d23185568fe84d7b5110cc51c92badc1cf615b993e3ecbfb5a96083786e.exe
Filesize2.7MB
MD527c06dcb55356f3a0b29adf2d8c081da
SHA1da28d6d3559a17322c78ac020175191115d0ba8c
SHA256a7b5fdd9c74942521e40ac592f8ed9ff51ba93033d175389841ff50b06c80a75
SHA512cf7463cecf1737267710ea35a144bd077dea0ea2b7f8663a70bd4f6129562505e8f65195ff407175e32b849af52197b4f3277450861efafb772aac93b1ba5c36
-
Filesize
1.5MB
MD56775542a38c0cc65efee6cf8d346b384
SHA1c91ca7e67d69c949fedba14d72fd9cf96459359a
SHA256146320f8bbff9e56aeee7b87a22ead991bd4cce94953a49288b0a2b07569f3d9
SHA51294d86e857b5e6fd9dad969ba77d31aa8cfa0714d23f1daafa7c380c3eeaf3283d3e9968786b65da8e4891fd23721e399e3217186ed31cda0688697b287b78f71