Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
c86d4db3a672a96e52bab96dba944e29.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c86d4db3a672a96e52bab96dba944e29.exe
Resource
win10v2004-20240226-en
General
-
Target
c86d4db3a672a96e52bab96dba944e29.exe
-
Size
316KB
-
MD5
c86d4db3a672a96e52bab96dba944e29
-
SHA1
7aa861b53decaee20ef1ca793056f4857e883439
-
SHA256
6b9f880c9522c934e059d4403d8dfd699f3b8be275a342b3b96675de1f87c671
-
SHA512
f20342f41fc9e9c7717e3ae5401c5212091d4df9e02c645d01c88fe051f7cfc15e81c96627d55d97a37d1a2de0572860eabd48ae0eb84c43b67c112e5246d79f
-
SSDEEP
6144:8Rae4PuyhfpILvis7kA4vryAAuSSTVsK2Kf5Urd:maeODFwis7kAwxVT2Ki
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation c86d4db3a672a96e52bab96dba944e29.exe -
Executes dropped EXE 1 IoCs
pid Process 4380 dobmmg.exe -
Loads dropped DLL 1 IoCs
pid Process 4380 dobmmg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3024 3408 WerFault.exe 87 2080 4380 WerFault.exe 101 -
Kills process with taskkill 1 IoCs
pid Process 1004 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3468 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1004 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3408 wrote to memory of 4876 3408 c86d4db3a672a96e52bab96dba944e29.exe 94 PID 3408 wrote to memory of 4876 3408 c86d4db3a672a96e52bab96dba944e29.exe 94 PID 3408 wrote to memory of 4876 3408 c86d4db3a672a96e52bab96dba944e29.exe 94 PID 4876 wrote to memory of 1004 4876 cmd.exe 96 PID 4876 wrote to memory of 1004 4876 cmd.exe 96 PID 4876 wrote to memory of 1004 4876 cmd.exe 96 PID 4876 wrote to memory of 3468 4876 cmd.exe 98 PID 4876 wrote to memory of 3468 4876 cmd.exe 98 PID 4876 wrote to memory of 3468 4876 cmd.exe 98 PID 4876 wrote to memory of 4380 4876 cmd.exe 101 PID 4876 wrote to memory of 4380 4876 cmd.exe 101 PID 4876 wrote to memory of 4380 4876 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\c86d4db3a672a96e52bab96dba944e29.exe"C:\Users\Admin\AppData\Local\Temp\c86d4db3a672a96e52bab96dba944e29.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 5002⤵
- Program crash
PID:3024
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 3408 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\c86d4db3a672a96e52bab96dba944e29.exe" & start C:\Users\Admin\AppData\Local\dobmmg.exe -f2⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 34083⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1004
-
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
PID:3468
-
-
C:\Users\Admin\AppData\Local\dobmmg.exeC:\Users\Admin\AppData\Local\dobmmg.exe -f3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 4284⤵
- Program crash
PID:2080
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3408 -ip 34081⤵PID:312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4380 -ip 43801⤵PID:1664
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD5c86d4db3a672a96e52bab96dba944e29
SHA17aa861b53decaee20ef1ca793056f4857e883439
SHA2566b9f880c9522c934e059d4403d8dfd699f3b8be275a342b3b96675de1f87c671
SHA512f20342f41fc9e9c7717e3ae5401c5212091d4df9e02c645d01c88fe051f7cfc15e81c96627d55d97a37d1a2de0572860eabd48ae0eb84c43b67c112e5246d79f