Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 18:18

General

  • Target

    0694e9d5f302540acda956ba60861153f0c617feffcf556fb874a531d947ff29.exe

  • Size

    103KB

  • MD5

    5d2d36e7d41e9969aa5164d77a06818d

  • SHA1

    f0b1dcba48d2b02641b65a28213fe8908cf9f590

  • SHA256

    0694e9d5f302540acda956ba60861153f0c617feffcf556fb874a531d947ff29

  • SHA512

    aa4327aad1bd66b0c5eb2224fd86dbcb3baad6dcd23c9d8e5cec0376c2f8a760f261fdd862f901985510dea5790c7173f189e432a0a45703dc890f521849b42d

  • SSDEEP

    3072:sm+fXDeHEPTi6HiGLraYV6Z+RwPONXoRjDhIcp0fDlaGGx+cL26nASvVSTvE:sHvOQHXraYoZ+RwPONXoRjDhIcp0fDl4

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0694e9d5f302540acda956ba60861153f0c617feffcf556fb874a531d947ff29.exe
    "C:\Users\Admin\AppData\Local\Temp\0694e9d5f302540acda956ba60861153f0c617feffcf556fb874a531d947ff29.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Users\Admin\AppData\Roaming\Microsoft\winlogdate.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\winlogdate.exe
      2⤵
      • Executes dropped EXE
      PID:4508
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 956
        3⤵
        • Program crash
        PID:1908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 908
        3⤵
        • Program crash
        PID:3788
    • C:\Windows\SysWOW64\regedit.exe
      regedit /s C:\Users\Admin\AppData\Local\Temp\kb71271.log
      2⤵
      • Adds Run key to start application
      • Runs regedit.exe
      PID:2312
    • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\~tasyd3.xls"
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2552
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4508 -ip 4508
    1⤵
      PID:3704
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4508 -ip 4508
      1⤵
        PID:568

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\kb71271.log

        Filesize

        155B

        MD5

        7a7e633bc48b5bfbca53c568eaa28fe6

        SHA1

        32956698ceca3a79f21be91d655a6265dbd325b2

        SHA256

        7707e565fa020d2b20ff2a9650ff9a5f2d64323474dc4e4253dc4b53c4ecabfc

        SHA512

        3592b4ff34b7d85ddb225d2f0573208e12b3b62a76f3dffe7a36790c26a586544ab52973cb9c0eb587f27352d7e88f0a475d29426f977e53d71628bbd84e6f39

      • C:\Users\Admin\AppData\Local\Temp\~tasyd3.xls

        Filesize

        42KB

        MD5

        3e6e32ff547a361fea67cb9198016a34

        SHA1

        3617400d2f3cbfed0ab1427c50bd7b58e52e43fa

        SHA256

        970eebd3a719020c9fc2f58b58d1c7104498a76e71885ec39b41323b520494e4

        SHA512

        f3cf6b2b2f95d5fca07179e07e0163c2447ac297c1efc88d374d50d99595fcb9c536a32ba8d4c38953d66b7e8425b8883da89fd001324a385a8772ad8343f73b

      • C:\Users\Admin\AppData\Roaming\Microsoft\winlogdate.exe

        Filesize

        41KB

        MD5

        ba4f88fe44d02a299dbeab18c37f74f3

        SHA1

        f77d5dfccc1796b6f93156dea470c3bf20dba6c8

        SHA256

        8a12e9117f023c7207272ff291ee1a686b636890cd616b92cff990c369d993f6

        SHA512

        badfaaa1a89a8184d7715fbde0a578876863ec517e27096c6621b11dcfdf7585e9039ab33b019fa01dcbed3194a990aecc3fe1c5a3646c54dee9208377c87504

      • memory/2552-35-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-37-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-26-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-27-0x00007FFA3D7B0000-0x00007FFA3D7C0000-memory.dmp

        Filesize

        64KB

      • memory/2552-29-0x00007FFA3D7B0000-0x00007FFA3D7C0000-memory.dmp

        Filesize

        64KB

      • memory/2552-30-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-32-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-31-0x00007FFA3D7B0000-0x00007FFA3D7C0000-memory.dmp

        Filesize

        64KB

      • memory/2552-34-0x00007FFA3D7B0000-0x00007FFA3D7C0000-memory.dmp

        Filesize

        64KB

      • memory/2552-25-0x00007FFA3D7B0000-0x00007FFA3D7C0000-memory.dmp

        Filesize

        64KB

      • memory/2552-36-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-28-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-33-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-38-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-39-0x00007FFA3AF00000-0x00007FFA3AF10000-memory.dmp

        Filesize

        64KB

      • memory/2552-40-0x00007FFA3AF00000-0x00007FFA3AF10000-memory.dmp

        Filesize

        64KB

      • memory/2552-53-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-54-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-68-0x00007FFA3D7B0000-0x00007FFA3D7C0000-memory.dmp

        Filesize

        64KB

      • memory/2552-69-0x00007FFA3D7B0000-0x00007FFA3D7C0000-memory.dmp

        Filesize

        64KB

      • memory/2552-70-0x00007FFA3D7B0000-0x00007FFA3D7C0000-memory.dmp

        Filesize

        64KB

      • memory/2552-71-0x00007FFA3D7B0000-0x00007FFA3D7C0000-memory.dmp

        Filesize

        64KB

      • memory/2552-72-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB

      • memory/2552-73-0x00007FFA7D730000-0x00007FFA7D925000-memory.dmp

        Filesize

        2.0MB