Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
129s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
13/05/2024, 12:33
General
-
Target
WaFilterApp.exe
-
Size
14.4MB
-
MD5
a4d195ccd7822ad76ae51614207ff64c
-
SHA1
76e37dd3761693b27d4b3ed95b1f899d8fa73a6d
-
SHA256
16538ee182d296f247a9a1d9c6b6f6ef8b0c098d68b14aeaa0c04727b34ed18f
-
SHA512
961e35c9ed37150602361ef0bb78a4f7f8fab47293c8c34c5b8e50e2daf52f7319e35bdda57e646e8606ccd9ae4c3d8300f98ed0b6bf8b51ccd521e13b51c385
-
SSDEEP
196608:V1EXPC7hrKiqNpFExqlmEpGzSj6MqYFHSv4qKh3ogUU1CxFkQ52cD9ICRAz4SlmJ:jEfAhrQpWA9ql4qU3woEhIwAlw
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 11 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 27 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaFilterApp.exe"C:\Users\Admin\AppData\Local\Temp\WaFilterApp.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1KT09.tmp\WaFilterApp.tmp"C:\Users\Admin\AppData\Local\Temp\is-1KT09.tmp\WaFilterApp.tmp" /SL5="$401EC,14276700,844288,C:\Users\Admin\AppData\Local\Temp\WaFilterApp.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WaFilter\WaFilterNew.exe"C:\Program Files (x86)\WaFilter\WaFilterNew.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.0MB
MD56c92574a2e7f6cc727d6e38450b0a21a
SHA1d8fd77c39971341352032a264130fc7cd7e82594
SHA25665f903947d1903afc93998392d3cfb11d62bd95fe8e69e3a7ae6a42f684a2793
SHA51283de9a62ac216469bd6020179173b98f9489274ca52e9a3050be9d0628a795385ce4b5bd3068a337fc04e7ab2a0da3719f201d3c4946ca37c3f7d0f79ef48754
-
Filesize
4.3MB
MD5068b4f05eb35479a419bc55da643781e
SHA11d0fe6bb23bbd63dc6d4248f7c17afcf4bc16dea
SHA256477ebd61ce116c6908a1cd1e50bc93869f6f7b9c3e0e5757551e6dd2a01b4648
SHA512f9022c7d91364519f5b773fd641741637f89a4f4f8eb1406d1c594e0a286724cea7494fb047e810bbed0579b6870db49a6828b1c79808e4554d762f326a87dcc
-
Filesize
18KB
MD5820ed09c9f47ea5402c07fd043a60f59
SHA1701e93cb4ae7af22057dd352d3932df5ce493efb
SHA2560bc0807cd9d892de407f19b581458a25838cb47cdf6b578424b5fd3e7be274e3
SHA51241185ae9809f2d339832cb5671fb2cb3cbe0c5e8f83458220022db5efcca15be5e0c64724f93b5c57996d6f3b91e1c705ca0431cd02ba2b1b192fb608ac3e9ed
-
Filesize
35KB
MD5408813d612d0d9aab08af0051cbb6936
SHA1f3ee4ca0a5672c959d9a51924bc602e877d0bb75
SHA25640222b31104a79a1b336563dde85869e8c1824bddfa58904a020ebcc98a7e213
SHA512254bfc553feaa0b51cc6208272f51b79b9373621e02eaff225aa4e8615cf94e99980ae7257552c7c43b2bf3f624c1f906e2b38496401dfb791210797689f6f7e
-
Filesize
7KB
MD50e089c82dec49dfd68fa9f694e84dd67
SHA1bef968ceb3f36a7f78b0d50412981a62f13dac9e
SHA2560e09afc3a7a3ce435dd5d95bcba14b6579ac0874156e1fadea1f46205b5aaa3e
SHA5128964660545086fdb18a25d4889bb4a151b26aa6c20a03e74c2dd9e8d75aa115e64507a3362583f79acc352a8efcce16cd121501bff2106cbf7976e7f77539171
-
Filesize
2.6MB
MD585ca772e58a46df23cfc12b854ba3d84
SHA123752a6772732a57da7e37b60248c54a139d49a3
SHA256a8841c945f5d3117745fac3a64f7735a683eeff78e28a4754dbf75c2b09d3612
SHA512768aa9186676cf174bd6d7ade1e67f982baf56e41f816d78984a312a36ed5d99a05a26e395c6acd3e51311b3180708c4b7be773e3b31cde8845bc4a6b0450525
-
Filesize
518B
MD5993a2af70831587d2f611c7efb141f96
SHA1eda856d35705dad0dcecc49ae7367937b839eaa3
SHA256856026e81cc0bc78d5096f532a40d1ccb7f97044028d37447fd454a9a1582b49
SHA512005fe13d617bbd12ff57b77323cec187add8bf2322c56616df27ac0aa75bd86543d998e14a3a0b57719bc203de381e9add9d6fa4cd9dd42d0cd5ec6bb226751c
-
Filesize
742KB
MD5544cd51a596619b78e9b54b70088307d
SHA14769ddd2dbc1dc44b758964ed0bd231b85880b65
SHA256dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
SHA512f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719
-
Filesize
3.0MB
MD5050e34d6662fc104ddce974c90bf3511
SHA164e2332a244a8e94e71bb0def89b73ba1dd15839
SHA256516af84c5ad10b4df6f663b7b3e28617ed42da60ecf1561f04b621071e3dde38
SHA51275ff1ff4e8cfd25453b772646d8d81ee3670ff00d3b85dfb29e05e3ac5834a0000c776cdc2e7002bbaa7de14654e659cf39c22d93e470e5ebd643e8c97376e07
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4.3MB
-
Filesize
14.0MB
-
Filesize
48KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
2.6MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
876KB
-
Filesize
728KB
-
Filesize
876KB
-
Filesize
876KB