Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    162s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2024, 18:29

General

  • Target

    b815704e21bd4b6f404e18eb2d1f2e2a.exe

  • Size

    6.0MB

  • MD5

    b815704e21bd4b6f404e18eb2d1f2e2a

  • SHA1

    eb9e86eed8c023a86adaff7b1fad8227a67d7cb5

  • SHA256

    e203d0b6c493e342a4fbac8eb22f820747d2787bbb22d24fc5e68e2007bdef47

  • SHA512

    99210b8da8bdabbf13c807346da2aa460edec152d6c9788950a4a61488d299184cbf508c9c9d5cf949401bf93940b2e9be295097a91e1c45d576c1410f542a18

  • SSDEEP

    98304:Mvs6Qiu51kcakOWZDtQXWry7mBZbkcaksDjGDHRQlywbcakOWZDtQXWry7mBZbk/:MvskurkdiaWry7mbYdfPlbdiaWry7mbW

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Program crash 18 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe
    "C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe
      C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe" /TN v3dGbWFyc353 /F
        3⤵
        • Creates scheduled task(s)
        PID:524
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN v3dGbWFyc353 > C:\Users\Admin\AppData\Local\Temp\nE0JMP.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4544
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN v3dGbWFyc353
          4⤵
            PID:1244
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 604
          3⤵
          • Program crash
          PID:2556
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 632
          3⤵
          • Program crash
          PID:2908
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 668
          3⤵
          • Program crash
          PID:1444
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 672
          3⤵
          • Program crash
          PID:2164
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 672
          3⤵
          • Program crash
          PID:2916
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 768
          3⤵
          • Program crash
          PID:1784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1480
          3⤵
          • Program crash
          PID:2708
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1916
          3⤵
          • Program crash
          PID:3252
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 2024
          3⤵
          • Program crash
          PID:3304
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 2004
          3⤵
          • Program crash
          PID:2164
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1932
          3⤵
          • Program crash
          PID:2916
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 2140
          3⤵
          • Program crash
          PID:1784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 2164
          3⤵
          • Program crash
          PID:3044
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 2152
          3⤵
          • Program crash
          PID:4912
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1988
          3⤵
          • Program crash
          PID:1056
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 2140
          3⤵
          • Program crash
          PID:4968
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1944
          3⤵
          • Program crash
          PID:4864
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 664
          3⤵
          • Program crash
          PID:576
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4364 -ip 4364
      1⤵
        PID:2220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4364 -ip 4364
        1⤵
          PID:2336
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4364 -ip 4364
          1⤵
            PID:2952
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4364 -ip 4364
            1⤵
              PID:1820
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4364 -ip 4364
              1⤵
                PID:4080
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4364 -ip 4364
                1⤵
                  PID:1884
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4364 -ip 4364
                  1⤵
                    PID:5040
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 4364 -ip 4364
                    1⤵
                      PID:4684
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
                      1⤵
                        PID:2348
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4364 -ip 4364
                        1⤵
                          PID:2500
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4364 -ip 4364
                          1⤵
                            PID:1820
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4364 -ip 4364
                            1⤵
                              PID:4276
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4364 -ip 4364
                              1⤵
                                PID:3668
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4364 -ip 4364
                                1⤵
                                  PID:2772
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4364 -ip 4364
                                  1⤵
                                    PID:3592
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4364 -ip 4364
                                    1⤵
                                      PID:4024
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4364 -ip 4364
                                      1⤵
                                        PID:2636
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4364 -ip 4364
                                        1⤵
                                          PID:400
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4364 -ip 4364
                                          1⤵
                                            PID:652

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Temp\b815704e21bd4b6f404e18eb2d1f2e2a.exe

                                            Filesize

                                            1.7MB

                                            MD5

                                            99015da81b6e7fba079c4ec248dea402

                                            SHA1

                                            35699ea865796652fa5af5b3b4ea28192cb19476

                                            SHA256

                                            c5414c262a44c1d9c9acd7f82d56141f45fddf4339f047e1e28bfabb5fd8a488

                                            SHA512

                                            916b325328e5ec83cffb165331722c571926baf22760a826aaff383ea10d4f3f938b78d0e6d0680088e13c85e9ed91e76d98cf5df6922db94cceeb3c6bbd842c

                                          • C:\Users\Admin\AppData\Local\Temp\nE0JMP.xml

                                            Filesize

                                            1KB

                                            MD5

                                            e01ecf494c759c52ac00bd2bb61f8e11

                                            SHA1

                                            3e00ab337ed3fcfc8c42bc0b3ca245fcffbb5752

                                            SHA256

                                            a5c6aaa0d9ecb32be60f5e4bf84f19c59d9c8db5877c392e3eec6ec2d06e2e74

                                            SHA512

                                            e62326b468ad32e27fcce4799e837b314908ad63dad3ee9ea85f0493bccf4476fc08aaf4694e4d898e51de204a668317e50db7fd8703f26b1465358e3d3d30a4

                                          • memory/2484-0-0x0000000000400000-0x000000000065C000-memory.dmp

                                            Filesize

                                            2.4MB

                                          • memory/2484-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                            Filesize

                                            428KB

                                          • memory/2484-4-0x0000000025020000-0x000000002509E000-memory.dmp

                                            Filesize

                                            504KB

                                          • memory/2484-13-0x0000000000400000-0x000000000046B000-memory.dmp

                                            Filesize

                                            428KB

                                          • memory/4364-14-0x0000000000400000-0x000000000065C000-memory.dmp

                                            Filesize

                                            2.4MB

                                          • memory/4364-20-0x00000000017A0000-0x000000000181E000-memory.dmp

                                            Filesize

                                            504KB

                                          • memory/4364-22-0x0000000000470000-0x00000000004DB000-memory.dmp

                                            Filesize

                                            428KB

                                          • memory/4364-23-0x0000000000400000-0x000000000045B000-memory.dmp

                                            Filesize

                                            364KB

                                          • memory/4364-32-0x0000000000400000-0x000000000065C000-memory.dmp

                                            Filesize

                                            2.4MB