Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2024, 18:33

General

  • Target

    c40ff7d4fbae3ba144f8739f7a7c2035.exe

  • Size

    1003KB

  • MD5

    c40ff7d4fbae3ba144f8739f7a7c2035

  • SHA1

    34683380e66e19640d89dd5e48c98d0e582c4b45

  • SHA256

    dcefe181389e4bbae16b0a5b0a9f705819c087f9afff15a797f4778af0e9757e

  • SHA512

    6d94b7aa2e17ecfc0d5fefac229d508724481567e0f2fd1ca4edeaa1bd37d2eb0b234aa92cf029a74158048acbf315dfbed4a182c669baef6ff4b83cb34fb855

  • SSDEEP

    24576:kNEIrnsALyscY1oqAacVonPHke5gEgKjwnS:kNE4nsAescPqAacVekV1KjwnS

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Program crash 8 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c40ff7d4fbae3ba144f8739f7a7c2035.exe
    "C:\Users\Admin\AppData\Local\Temp\c40ff7d4fbae3ba144f8739f7a7c2035.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1020
    • C:\Users\Admin\AppData\Local\Temp\c40ff7d4fbae3ba144f8739f7a7c2035.exe
      C:\Users\Admin\AppData\Local\Temp\c40ff7d4fbae3ba144f8739f7a7c2035.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1332
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\c40ff7d4fbae3ba144f8739f7a7c2035.exe" /TN v3dGbWFyc353 /F
        3⤵
        • Creates scheduled task(s)
        PID:1088
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN v3dGbWFyc353 > C:\Users\Admin\AppData\Local\Temp\eDip5G.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN v3dGbWFyc353
          4⤵
            PID:624
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 608
          3⤵
          • Program crash
          PID:1860
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 604
          3⤵
          • Program crash
          PID:1944
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 608
          3⤵
          • Program crash
          PID:4440
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 740
          3⤵
          • Program crash
          PID:2980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 736
          3⤵
          • Program crash
          PID:1904
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 792
          3⤵
          • Program crash
          PID:1940
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 1288
          3⤵
          • Program crash
          PID:1940
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 724
          3⤵
          • Program crash
          PID:4976
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1332 -ip 1332
      1⤵
        PID:2220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1332 -ip 1332
        1⤵
          PID:3012
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1332 -ip 1332
          1⤵
            PID:3464
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1332 -ip 1332
            1⤵
              PID:820
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1332 -ip 1332
              1⤵
                PID:2892
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1332 -ip 1332
                1⤵
                  PID:4508
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1332 -ip 1332
                  1⤵
                    PID:3812
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
                    1⤵
                      PID:2648
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1332 -ip 1332
                      1⤵
                        PID:2676

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\c40ff7d4fbae3ba144f8739f7a7c2035.exe

                        Filesize

                        1003KB

                        MD5

                        f26ad825200c32916c3a1c835f8fb7ed

                        SHA1

                        b5a625b5ab49de5678f4c61e696e85fc7403d47e

                        SHA256

                        647d20eb16c62c5901cc89d865516c572c37ec8c759882ed71f91a176c3d28e1

                        SHA512

                        de95d0faf69cd15c0c0a50b84129ed97f18c6c37b06451e72fb713ededc483e527a711100b445f26738d96528768460825bff660f85ae1c91f3ea21aa4eb3fc5

                      • C:\Users\Admin\AppData\Local\Temp\eDip5G.xml

                        Filesize

                        1KB

                        MD5

                        e33699ed28f98c97de9ec0f26a3a947e

                        SHA1

                        50830632aff1540ca6be3b46bce3fa27201d475a

                        SHA256

                        31a9f0abb5cc82a0b0c0dc71a189118ea267ead01cdf7927fc88e1c5245e1ae4

                        SHA512

                        e676c1015e1732fc3bc9b0136020939366c6c63761196712d5dcb8ed89b2899c46d7a2d2e9c69adfaba71062ff0f96992fb37a454b535e1a93925e2092a39326

                      • memory/1020-0-0x0000000000400000-0x000000000065C000-memory.dmp

                        Filesize

                        2.4MB

                      • memory/1020-2-0x0000000001730000-0x00000000017AE000-memory.dmp

                        Filesize

                        504KB

                      • memory/1020-1-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                      • memory/1020-15-0x0000000000400000-0x000000000046B000-memory.dmp

                        Filesize

                        428KB

                      • memory/1332-13-0x0000000000400000-0x000000000065C000-memory.dmp

                        Filesize

                        2.4MB

                      • memory/1332-17-0x0000000024010000-0x000000002408E000-memory.dmp

                        Filesize

                        504KB

                      • memory/1332-23-0x0000000000470000-0x00000000004DB000-memory.dmp

                        Filesize

                        428KB

                      • memory/1332-22-0x0000000000400000-0x000000000045B000-memory.dmp

                        Filesize

                        364KB

                      • memory/1332-32-0x0000000000400000-0x000000000065C000-memory.dmp

                        Filesize

                        2.4MB