Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 08:42

General

  • Target

    ae1f3bbd3e116661c35c4aaf7430472b.exe

  • Size

    3.0MB

  • MD5

    ae1f3bbd3e116661c35c4aaf7430472b

  • SHA1

    b877f774a5a38c4c754b94dc98308dc900e07935

  • SHA256

    0426b6382cb164e83c8198d8a5978099e177a55112180b321c7ebd6d3f102931

  • SHA512

    72677c7ba8b607b35ed9c9ff44436ac82bf565e92c83d2f75aec0cf5ab9ec8ce535609bb212bbeae49dbd405067e99e67b2e04aa6d62ebff59473e372e957dc3

  • SSDEEP

    49152:O3Suo2HNZz14C6DcakLVy5dv5sgpkB5+PcakLTSsiYMD4wPnQJcakLVy5dv5sgp4:O3k2HNt1scakhy595sgp9cak/SsiTD4M

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Program crash 18 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae1f3bbd3e116661c35c4aaf7430472b.exe
    "C:\Users\Admin\AppData\Local\Temp\ae1f3bbd3e116661c35c4aaf7430472b.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2244
    • C:\Users\Admin\AppData\Local\Temp\ae1f3bbd3e116661c35c4aaf7430472b.exe
      C:\Users\Admin\AppData\Local\Temp\ae1f3bbd3e116661c35c4aaf7430472b.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3340
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\ae1f3bbd3e116661c35c4aaf7430472b.exe" /TN BpPBJTFwdd09 /F
        3⤵
        • Creates scheduled task(s)
        PID:2124
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN BpPBJTFwdd09 > C:\Users\Admin\AppData\Local\Temp\Bnw6blXt.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5368
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN BpPBJTFwdd09
          4⤵
            PID:5912
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 608
          3⤵
          • Program crash
          PID:1600
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 632
          3⤵
          • Program crash
          PID:4188
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 716
          3⤵
          • Program crash
          PID:4684
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 720
          3⤵
          • Program crash
          PID:5420
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 740
          3⤵
          • Program crash
          PID:2556
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 780
          3⤵
          • Program crash
          PID:2496
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1468
          3⤵
          • Program crash
          PID:3716
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1476
          3⤵
          • Program crash
          PID:5224
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 2144
          3⤵
          • Program crash
          PID:3812
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1956
          3⤵
          • Program crash
          PID:684
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 2104
          3⤵
          • Program crash
          PID:5360
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 2000
          3⤵
          • Program crash
          PID:3516
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 2132
          3⤵
          • Program crash
          PID:5192
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1636
          3⤵
          • Program crash
          PID:2112
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1492
          3⤵
          • Program crash
          PID:4436
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 2164
          3⤵
          • Program crash
          PID:2560
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1644
          3⤵
          • Program crash
          PID:2996
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 712
          3⤵
          • Program crash
          PID:5724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3340 -ip 3340
      1⤵
        PID:876
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3340 -ip 3340
        1⤵
          PID:1764
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3340 -ip 3340
          1⤵
            PID:880
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3340 -ip 3340
            1⤵
              PID:4272
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3340 -ip 3340
              1⤵
                PID:640
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3340 -ip 3340
                1⤵
                  PID:2684
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3340 -ip 3340
                  1⤵
                    PID:5460
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3340 -ip 3340
                    1⤵
                      PID:4160
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3340 -ip 3340
                      1⤵
                        PID:4964
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3340 -ip 3340
                        1⤵
                          PID:4960
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3340 -ip 3340
                          1⤵
                            PID:6080
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3340 -ip 3340
                            1⤵
                              PID:1440
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3340 -ip 3340
                              1⤵
                                PID:5892
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3340 -ip 3340
                                1⤵
                                  PID:5064
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3340 -ip 3340
                                  1⤵
                                    PID:1784
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3340 -ip 3340
                                    1⤵
                                      PID:5576
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3340 -ip 3340
                                      1⤵
                                        PID:2392
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3340 -ip 3340
                                        1⤵
                                          PID:5312

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\Bnw6blXt.xml

                                          Filesize

                                          1KB

                                          MD5

                                          a68d8437a03a52dbdd61ad10ef511c79

                                          SHA1

                                          4a0a1f3f03b00d8807267a5a926a707cdb591af1

                                          SHA256

                                          f4cfbf01d2cfddcb684ca2f979d0829eafbb83244792b067e54f0ad74db6f994

                                          SHA512

                                          b42957fbcf3c838c110c9ac5ad41dddfd56229b13d553f07834df96849988583ce59ed33a80ae1b6ddc67b6ef8891c6c6941f0c4d98967979b1079ee95fb4772

                                        • C:\Users\Admin\AppData\Local\Temp\ae1f3bbd3e116661c35c4aaf7430472b.exe

                                          Filesize

                                          3.0MB

                                          MD5

                                          fb31df43cba5b9b5572f1592d7af2d83

                                          SHA1

                                          d71f7f021f274f62386cc652b47c15ddd4f410a6

                                          SHA256

                                          1d7ce4f53366c194f4a56cb8728ea2da8534946d6e634db79e9d6a3d0adc5d1e

                                          SHA512

                                          b6e559bd44cb40389fdbd940929bbf02a083f39a9e38ba4ca47ae05d265f9aa400fd6116cc33f47ee1e2abf9a80f801efacceaa881d39392f579cc105f91fe97

                                        • memory/2244-0-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB

                                        • memory/2244-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/2244-2-0x0000000025010000-0x000000002508E000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/2244-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/3340-15-0x0000000023FE0000-0x000000002405E000-memory.dmp

                                          Filesize

                                          504KB

                                        • memory/3340-18-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB

                                        • memory/3340-22-0x00000000004B0000-0x000000000051B000-memory.dmp

                                          Filesize

                                          428KB

                                        • memory/3340-23-0x0000000000400000-0x000000000045B000-memory.dmp

                                          Filesize

                                          364KB

                                        • memory/3340-40-0x0000000000400000-0x000000000065C000-memory.dmp

                                          Filesize

                                          2.4MB