Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/03/2024, 07:55
General
-
Target
be1321f0e89455a22121a114f8464564.exe
-
Size
332KB
-
MD5
be1321f0e89455a22121a114f8464564
-
SHA1
30030417ffe3d50a912773668a87fd855f412a62
-
SHA256
fd8fdd234a9b2b0707fce4d30b006722040f873f8f3b53df944fadc240142518
-
SHA512
454057d2b00582eeef38f598c9a58ba5127f5c747421aa710e353efcebcaeff652b7525592647803e6d44af750f44a21f459994aae29bfbef27a24326af60ef4
-
SSDEEP
6144:d+gB3OD1dXvmTrmgE5YzTLUlzmyksWa6mPQptW3MwO+F:doDDvmTSgE6TLUBmnzaZPQbZv
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Kills process with taskkill 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\be1321f0e89455a22121a114f8464564.exe"C:\Users\Admin\AppData\Local\Temp\be1321f0e89455a22121a114f8464564.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 5562⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 212 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\be1321f0e89455a22121a114f8464564.exe" & start C:\Users\Admin\AppData\Local\UKPQMQ~1.EXE -f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 2123⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\ukpqmqkvh.exeC:\Users\Admin\AppData\Local\UKPQMQ~1.EXE -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3040 -s 5684⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 212 -ip 2121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3040 -ip 30401⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD5be1321f0e89455a22121a114f8464564
SHA130030417ffe3d50a912773668a87fd855f412a62
SHA256fd8fdd234a9b2b0707fce4d30b006722040f873f8f3b53df944fadc240142518
SHA512454057d2b00582eeef38f598c9a58ba5127f5c747421aa710e353efcebcaeff652b7525592647803e6d44af750f44a21f459994aae29bfbef27a24326af60ef4
-
Filesize
728KB
-
Filesize
8KB
-
Filesize
728KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
8KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
8KB