Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
b52254949fd52113e0888401f2ddfb76.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b52254949fd52113e0888401f2ddfb76.exe
Resource
win10v2004-20240226-en
General
-
Target
b52254949fd52113e0888401f2ddfb76.exe
-
Size
323KB
-
MD5
b52254949fd52113e0888401f2ddfb76
-
SHA1
4ee5d96d55819ba88030f67bbb266273b308d55b
-
SHA256
56f6a0b5eaad6add2e0178407f31f462c432e614da0c86a8c803747589066855
-
SHA512
dd8ffe0cb977b2eb7f26505ec0a316ece3ba5e20641e09594e038ca86bf842347f601f4491fb262d24fb4da235942a7ed1551f670add62c972dbe81df9fcf0f6
-
SSDEEP
6144:8WE5Op3aq/md4qKMjD/goFARqmqXcTs17ppL7gpbnAapYUpRr9uW:8B5OpqgbpIpFiHk7nL7SuW
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation b52254949fd52113e0888401f2ddfb76.exe -
Executes dropped EXE 1 IoCs
pid Process 2152 xsalhach.exe -
Loads dropped DLL 1 IoCs
pid Process 2152 xsalhach.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1360 3312 WerFault.exe 87 2884 2152 WerFault.exe 99 -
Kills process with taskkill 1 IoCs
pid Process 2400 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3256 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2400 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3312 wrote to memory of 3460 3312 b52254949fd52113e0888401f2ddfb76.exe 94 PID 3312 wrote to memory of 3460 3312 b52254949fd52113e0888401f2ddfb76.exe 94 PID 3312 wrote to memory of 3460 3312 b52254949fd52113e0888401f2ddfb76.exe 94 PID 3460 wrote to memory of 2400 3460 cmd.exe 96 PID 3460 wrote to memory of 2400 3460 cmd.exe 96 PID 3460 wrote to memory of 2400 3460 cmd.exe 96 PID 3460 wrote to memory of 3256 3460 cmd.exe 98 PID 3460 wrote to memory of 3256 3460 cmd.exe 98 PID 3460 wrote to memory of 3256 3460 cmd.exe 98 PID 3460 wrote to memory of 2152 3460 cmd.exe 99 PID 3460 wrote to memory of 2152 3460 cmd.exe 99 PID 3460 wrote to memory of 2152 3460 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\b52254949fd52113e0888401f2ddfb76.exe"C:\Users\Admin\AppData\Local\Temp\b52254949fd52113e0888401f2ddfb76.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3312 -s 5562⤵
- Program crash
PID:1360
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 3312 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\b52254949fd52113e0888401f2ddfb76.exe" & start C:\Users\Admin\AppData\Local\xsalhach.exe -f2⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 33123⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:3256
-
-
C:\Users\Admin\AppData\Local\xsalhach.exeC:\Users\Admin\AppData\Local\xsalhach.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 5684⤵
- Program crash
PID:2884
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3312 -ip 33121⤵PID:1548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2152 -ip 21521⤵PID:1952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
323KB
MD5b52254949fd52113e0888401f2ddfb76
SHA14ee5d96d55819ba88030f67bbb266273b308d55b
SHA25656f6a0b5eaad6add2e0178407f31f462c432e614da0c86a8c803747589066855
SHA512dd8ffe0cb977b2eb7f26505ec0a316ece3ba5e20641e09594e038ca86bf842347f601f4491fb262d24fb4da235942a7ed1551f670add62c972dbe81df9fcf0f6