Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
b6202f30b837ad0025da86ecf9f5f1c9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b6202f30b837ad0025da86ecf9f5f1c9.exe
Resource
win10v2004-20240226-en
General
-
Target
b6202f30b837ad0025da86ecf9f5f1c9.exe
-
Size
12.6MB
-
MD5
b6202f30b837ad0025da86ecf9f5f1c9
-
SHA1
ac922759c8dde66341dd92f557c828b894aa0cfb
-
SHA256
b6768d16dbabafc1d9d07cdd065c875522cce0b6ee493187ba984e3e87b0aece
-
SHA512
ddf185d38b0ad7b7c8a69c27830c388ef3d20a3430cea4aecdeeae857b5d9209be4fda62d06b91b2018cd1d9f52f521fc95c5f9989ba4c54bd6f21bc4ebac527
-
SSDEEP
12288:ZRXQK44fy6111111111111111111111111111111111111111111111111111111:ZRx2
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 868 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\iferdxve\ImagePath = "C:\\Windows\\SysWOW64\\iferdxve\\qmeebqpd.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation b6202f30b837ad0025da86ecf9f5f1c9.exe -
Deletes itself 1 IoCs
pid Process 1612 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 4872 qmeebqpd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4872 set thread context of 1612 4872 qmeebqpd.exe 152 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 572 sc.exe 3620 sc.exe 1236 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 22 IoCs
pid pid_target Process procid_target 1620 4932 WerFault.exe 87 3608 4932 WerFault.exe 87 2784 4932 WerFault.exe 87 4984 4932 WerFault.exe 87 1712 4932 WerFault.exe 87 4500 4932 WerFault.exe 87 5028 4932 WerFault.exe 87 1876 4932 WerFault.exe 87 2780 4932 WerFault.exe 87 4980 4932 WerFault.exe 87 2244 4932 WerFault.exe 87 3956 4932 WerFault.exe 87 4324 4932 WerFault.exe 87 3604 4932 WerFault.exe 87 2112 4932 WerFault.exe 87 5024 4932 WerFault.exe 87 4628 4932 WerFault.exe 87 3740 4932 WerFault.exe 87 4732 4932 WerFault.exe 87 1836 4872 WerFault.exe 141 3568 4872 WerFault.exe 141 1888 4872 WerFault.exe 141 -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 4932 wrote to memory of 1248 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 112 PID 4932 wrote to memory of 1248 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 112 PID 4932 wrote to memory of 1248 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 112 PID 4932 wrote to memory of 4460 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 118 PID 4932 wrote to memory of 4460 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 118 PID 4932 wrote to memory of 4460 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 118 PID 4932 wrote to memory of 572 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 125 PID 4932 wrote to memory of 572 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 125 PID 4932 wrote to memory of 572 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 125 PID 4932 wrote to memory of 3620 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 131 PID 4932 wrote to memory of 3620 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 131 PID 4932 wrote to memory of 3620 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 131 PID 4932 wrote to memory of 1236 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 137 PID 4932 wrote to memory of 1236 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 137 PID 4932 wrote to memory of 1236 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 137 PID 4932 wrote to memory of 868 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 144 PID 4932 wrote to memory of 868 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 144 PID 4932 wrote to memory of 868 4932 b6202f30b837ad0025da86ecf9f5f1c9.exe 144 PID 4872 wrote to memory of 1612 4872 qmeebqpd.exe 152 PID 4872 wrote to memory of 1612 4872 qmeebqpd.exe 152 PID 4872 wrote to memory of 1612 4872 qmeebqpd.exe 152 PID 4872 wrote to memory of 1612 4872 qmeebqpd.exe 152 PID 4872 wrote to memory of 1612 4872 qmeebqpd.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6202f30b837ad0025da86ecf9f5f1c9.exe"C:\Users\Admin\AppData\Local\Temp\b6202f30b837ad0025da86ecf9f5f1c9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 5962⤵
- Program crash
PID:1620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 7242⤵
- Program crash
PID:3608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 7242⤵
- Program crash
PID:2784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 8242⤵
- Program crash
PID:4984
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 8122⤵
- Program crash
PID:1712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 9762⤵
- Program crash
PID:4500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 9882⤵
- Program crash
PID:5028
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 8242⤵
- Program crash
PID:1876
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\iferdxve\2⤵PID:1248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 9122⤵
- Program crash
PID:2780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 5802⤵
- Program crash
PID:4980
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qmeebqpd.exe" C:\Windows\SysWOW64\iferdxve\2⤵PID:4460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 12242⤵
- Program crash
PID:2244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 11962⤵
- Program crash
PID:3956
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create iferdxve binPath= "C:\Windows\SysWOW64\iferdxve\qmeebqpd.exe /d\"C:\Users\Admin\AppData\Local\Temp\b6202f30b837ad0025da86ecf9f5f1c9.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 12762⤵
- Program crash
PID:4324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 12882⤵
- Program crash
PID:3604
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description iferdxve "wifi internet conection"2⤵
- Launches sc.exe
PID:3620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 13442⤵
- Program crash
PID:2112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 12562⤵
- Program crash
PID:5024
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start iferdxve2⤵
- Launches sc.exe
PID:1236
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 12962⤵
- Program crash
PID:4628
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 5882⤵
- Program crash
PID:3740
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 10362⤵
- Program crash
PID:4732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4932 -ip 49321⤵PID:4608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4932 -ip 49321⤵PID:3472
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4932 -ip 49321⤵PID:2676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4932 -ip 49321⤵PID:4740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4932 -ip 49321⤵PID:4636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4932 -ip 49321⤵PID:3356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4932 -ip 49321⤵PID:2836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4932 -ip 49321⤵PID:5048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4932 -ip 49321⤵PID:1976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4932 -ip 49321⤵PID:2012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4932 -ip 49321⤵PID:1764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4932 -ip 49321⤵PID:3980
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4932 -ip 49321⤵PID:556
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4932 -ip 49321⤵PID:1884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4932 -ip 49321⤵PID:116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4932 -ip 49321⤵PID:3428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4932 -ip 49321⤵PID:1852
-
C:\Windows\SysWOW64\iferdxve\qmeebqpd.exeC:\Windows\SysWOW64\iferdxve\qmeebqpd.exe /d"C:\Users\Admin\AppData\Local\Temp\b6202f30b837ad0025da86ecf9f5f1c9.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 5242⤵
- Program crash
PID:1836
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:1612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 5322⤵
- Program crash
PID:3568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 5682⤵
- Program crash
PID:1888
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4932 -ip 49321⤵PID:1956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4932 -ip 49321⤵PID:232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4872 -ip 48721⤵PID:468
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4872 -ip 48721⤵PID:1764
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4872 -ip 48721⤵PID:3928
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.3MB
MD52e0e424c4a700fb8797bfbc8f2cdb338
SHA16b02e7ae370abb0853e8c357211c047a794f6324
SHA2565db817993ffbdf931b750fb3fa408f1238d21da7422b0c9750a4d34ac1a67fcc
SHA51226e7bc05a5498844553e7834371c81d91fb1bb209801cf21b74bdfc755a0edf121355f582c93cf4ec6d1cc8e74b184a6e50e19fceba587899211a22cdd0fc1ef
-
Filesize
7.1MB
MD5469f3d88bd8bcd180aaa91a5e10d46cd
SHA1b0ec8d3d5fdbe473b70984e60274f21da7dd7ff9
SHA25688f32e147e340b151f876517183ffebc1e5df84e54f9e6daf8fa3470e1b6f81e
SHA512e5a1b27bcb4d8882f65c4301fead16e2e91dfbd3d3ca6b0d8a1187b99d777a98582f17ce3ca1b87ef29ae9eebb8432ea13d9fb1f067282aa589aed5302a62fcb