Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/03/2024, 07:55

General

  • Target

    be1321f0e89455a22121a114f8464564.exe

  • Size

    332KB

  • MD5

    be1321f0e89455a22121a114f8464564

  • SHA1

    30030417ffe3d50a912773668a87fd855f412a62

  • SHA256

    fd8fdd234a9b2b0707fce4d30b006722040f873f8f3b53df944fadc240142518

  • SHA512

    454057d2b00582eeef38f598c9a58ba5127f5c747421aa710e353efcebcaeff652b7525592647803e6d44af750f44a21f459994aae29bfbef27a24326af60ef4

  • SSDEEP

    6144:d+gB3OD1dXvmTrmgE5YzTLUlzmyksWa6mPQptW3MwO+F:doDDvmTSgE6TLUBmnzaZPQbZv

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be1321f0e89455a22121a114f8464564.exe
    "C:\Users\Admin\AppData\Local\Temp\be1321f0e89455a22121a114f8464564.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 556
      2⤵
      • Program crash
      PID:1604
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 212 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\be1321f0e89455a22121a114f8464564.exe" & start C:\Users\Admin\AppData\Local\UKPQMQ~1.EXE -f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /pid 212
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4716
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 3 127.1
        3⤵
        • Runs ping.exe
        PID:4476
      • C:\Users\Admin\AppData\Local\ukpqmqkvh.exe
        C:\Users\Admin\AppData\Local\UKPQMQ~1.EXE -f
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3040
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 568
          4⤵
          • Program crash
          PID:4984
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 212 -ip 212
    1⤵
      PID:4372
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3040 -ip 3040
      1⤵
        PID:1016
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:4836
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1752

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\ukpqmqkvh.exe

          Filesize

          332KB

          MD5

          be1321f0e89455a22121a114f8464564

          SHA1

          30030417ffe3d50a912773668a87fd855f412a62

          SHA256

          fd8fdd234a9b2b0707fce4d30b006722040f873f8f3b53df944fadc240142518

          SHA512

          454057d2b00582eeef38f598c9a58ba5127f5c747421aa710e353efcebcaeff652b7525592647803e6d44af750f44a21f459994aae29bfbef27a24326af60ef4

        • memory/212-1-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/212-2-0x0000000000D40000-0x0000000000D42000-memory.dmp

          Filesize

          8KB

        • memory/212-4-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/212-0-0x0000000000D60000-0x0000000000D62000-memory.dmp

          Filesize

          8KB

        • memory/1752-39-0x0000020B4CE40000-0x0000020B4CE50000-memory.dmp

          Filesize

          64KB

        • memory/1752-75-0x0000020B553A0000-0x0000020B553A1000-memory.dmp

          Filesize

          4KB

        • memory/1752-74-0x0000020B55290000-0x0000020B55291000-memory.dmp

          Filesize

          4KB

        • memory/1752-73-0x0000020B55290000-0x0000020B55291000-memory.dmp

          Filesize

          4KB

        • memory/1752-71-0x0000020B55260000-0x0000020B55261000-memory.dmp

          Filesize

          4KB

        • memory/1752-55-0x0000020B4CF40000-0x0000020B4CF50000-memory.dmp

          Filesize

          64KB

        • memory/3040-18-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/3040-22-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/3040-25-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/3040-27-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/3040-29-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/3040-31-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/3040-20-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/3040-16-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/3040-15-0x0000000000450000-0x0000000000452000-memory.dmp

          Filesize

          8KB

        • memory/3040-13-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/3040-11-0x0000000001000000-0x00000000010B6000-memory.dmp

          Filesize

          728KB

        • memory/3040-8-0x0000000000450000-0x0000000000452000-memory.dmp

          Filesize

          8KB