Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/02/2024, 09:33

General

  • Target

    ab92553392399eb29fd766645331624f.exe

  • Size

    150KB

  • MD5

    ab92553392399eb29fd766645331624f

  • SHA1

    7313794977a4e0a6654c1e089620d0efe14ca344

  • SHA256

    4f5644b3080f5142b16bad5345916d73c55d45ceb9c5f65160e3952cb03d4716

  • SHA512

    8027b18415aef5048c3476930dea8596fdda9238fbc1c61aec62eb4c095f55907b6593569e2b0deb953d4fe5ded831601dad2dd9df2fa69eb8d00b5f0c0c585a

  • SSDEEP

    3072:hUVMf+osr7kaDioQciE3t/01BDpAzhtbB9GdfCdt7VBpHEioayYSDHLImHeP7E:hkw+BrYTRciRA1RB+S7r1WDDNj

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab92553392399eb29fd766645331624f.exe
    "C:\Users\Admin\AppData\Local\Temp\ab92553392399eb29fd766645331624f.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:428
    • C:\Windows\1.exe
      "C:\Windows\1.exe"
      2⤵
      • Executes dropped EXE
      PID:4256
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 224
        3⤵
        • Program crash
        PID:1908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4256 -ip 4256
    1⤵
      PID:220

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\1.exe

      Filesize

      131KB

      MD5

      2fe1a4b5d26343029291cb6bced9f508

      SHA1

      2d4ecc208ca8ac41332a133110d11130d0cc216f

      SHA256

      e8a665f351e024924a721b035bc6d43f1c6c6fdfaf5361194af4a8eb94e63a49

      SHA512

      a6b9fd9861283a65448358048a2d8f9451ef8b2f74c17da2a26f8088ed4cd2c0cf79a479bd6ce95669f7c74bdcb5c5dd1104a30a9367029dc2b0cd284eeb7e53

    • memory/428-0-0x0000000000400000-0x0000000000427200-memory.dmp

      Filesize

      156KB

    • memory/4256-9-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB

    • memory/4256-10-0x0000000000400000-0x000000000044E000-memory.dmp

      Filesize

      312KB