Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe
Resource
win10v2004-20240226-en
General
-
Target
8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe
-
Size
442KB
-
MD5
0172a14cc31c07e8297ea92083c94551
-
SHA1
457abd00a63729c1a5ed3f259e9d2865184a9f3d
-
SHA256
8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5
-
SHA512
1a9c6f225e44015485fda7531233bcf09e5303965aed791475de1b783f00574d6d2cd2424e7eb3df3a57884420564ab8f733541e7ed01dacc591a370e4de326f
-
SSDEEP
12288:MUwAyBoj109MuP7/EQv2xZvOaOujZpHGY:b6SuMuLIxzX1UY
Malware Config
Extracted
amadey
4.21
9a3efc
http://check-ftp.ru
-
install_dir
b9695770f1
-
install_file
Dctooux.exe
-
strings_key
1d3a0f2941c4060dba7f23a378474944
-
url_paths
/forum/index.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe -
Executes dropped EXE 3 IoCs
pid Process 3964 Dctooux.exe 548 Dctooux.exe 2960 Dctooux.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Dctooux.job 8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 29 IoCs
pid pid_target Process procid_target 3992 1424 WerFault.exe 89 4840 1424 WerFault.exe 89 2980 1424 WerFault.exe 89 3480 1424 WerFault.exe 89 3440 1424 WerFault.exe 89 3880 1424 WerFault.exe 89 3632 1424 WerFault.exe 89 1328 1424 WerFault.exe 89 3864 1424 WerFault.exe 89 3124 1424 WerFault.exe 89 1160 3964 WerFault.exe 114 4372 3964 WerFault.exe 114 3548 3964 WerFault.exe 114 3484 3964 WerFault.exe 114 3776 3964 WerFault.exe 114 820 3964 WerFault.exe 114 2980 3964 WerFault.exe 114 2192 3964 WerFault.exe 114 3500 3964 WerFault.exe 114 1932 3964 WerFault.exe 114 3468 3964 WerFault.exe 114 3636 3964 WerFault.exe 114 1376 3964 WerFault.exe 114 1320 3964 WerFault.exe 114 1768 3964 WerFault.exe 114 2908 3964 WerFault.exe 114 5112 548 WerFault.exe 152 1376 2960 WerFault.exe 156 3000 3964 WerFault.exe 114 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1424 8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1424 wrote to memory of 3964 1424 8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe 114 PID 1424 wrote to memory of 3964 1424 8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe 114 PID 1424 wrote to memory of 3964 1424 8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe"C:\Users\Admin\AppData\Local\Temp\8d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 7562⤵
- Program crash
PID:3992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 8042⤵
- Program crash
PID:4840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 8602⤵
- Program crash
PID:2980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 8682⤵
- Program crash
PID:3480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 8642⤵
- Program crash
PID:3440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 9202⤵
- Program crash
PID:3880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 11442⤵
- Program crash
PID:3632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 11362⤵
- Program crash
PID:1328
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 11642⤵
- Program crash
PID:3864
-
-
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe"2⤵
- Executes dropped EXE
PID:3964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 5563⤵
- Program crash
PID:1160
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 5643⤵
- Program crash
PID:4372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 5963⤵
- Program crash
PID:3548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 6643⤵
- Program crash
PID:3484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 7243⤵
- Program crash
PID:3776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 8883⤵
- Program crash
PID:820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 6963⤵
- Program crash
PID:2980
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 8883⤵
- Program crash
PID:2192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 8883⤵
- Program crash
PID:3500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 6803⤵
- Program crash
PID:1932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 10163⤵
- Program crash
PID:3468
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 11683⤵
- Program crash
PID:3636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 12283⤵
- Program crash
PID:1376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 12403⤵
- Program crash
PID:1320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 12403⤵
- Program crash
PID:1768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 13003⤵
- Program crash
PID:2908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 8923⤵
- Program crash
PID:3000
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 13322⤵
- Program crash
PID:3124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 1424 -ip 14241⤵PID:4084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1424 -ip 14241⤵PID:4160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1424 -ip 14241⤵PID:2768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1424 -ip 14241⤵PID:3000
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1424 -ip 14241⤵PID:888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1424 -ip 14241⤵PID:3404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1424 -ip 14241⤵PID:2972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1424 -ip 14241⤵PID:2452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1424 -ip 14241⤵PID:3636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1424 -ip 14241⤵PID:1224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3964 -ip 39641⤵PID:4364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3964 -ip 39641⤵PID:1176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3964 -ip 39641⤵PID:4464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3964 -ip 39641⤵PID:1892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3964 -ip 39641⤵PID:2136
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3964 -ip 39641⤵PID:544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3964 -ip 39641⤵PID:4880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3964 -ip 39641⤵PID:5088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3964 -ip 39641⤵PID:1568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3964 -ip 39641⤵PID:3880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3964 -ip 39641⤵PID:1332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3964 -ip 39641⤵PID:3580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3964 -ip 39641⤵PID:3872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3964 -ip 39641⤵PID:2788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3964 -ip 39641⤵PID:3320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3964 -ip 39641⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe1⤵
- Executes dropped EXE
PID:548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 4442⤵
- Program crash
PID:5112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 548 -ip 5481⤵PID:2728
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\b9695770f1\Dctooux.exe1⤵
- Executes dropped EXE
PID:2960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 4522⤵
- Program crash
PID:1376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2960 -ip 29601⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3964 -ip 39641⤵PID:2768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD59b7db0d8c611500850a73f324cc7ab39
SHA1002df99af9ca70637671df24bbcd3becc9e34597
SHA25624da57310920392548fa59d68dc3ffa92b5467b5b11edcf4e71dd6b6ab9f1373
SHA512a58a40b0eb6d6746ac42d788e5fe735394f1a3764e31d6b866c599742e2c85fef72bdebdf01a98bd95320f7ba936611ec45bbdedabddab81da4e257b2fcc36eb
-
Filesize
442KB
MD50172a14cc31c07e8297ea92083c94551
SHA1457abd00a63729c1a5ed3f259e9d2865184a9f3d
SHA2568d46c40c409984308bf9a43673dcfd97a9b460114869194e8163aaf06d74f2d5
SHA5121a9c6f225e44015485fda7531233bcf09e5303965aed791475de1b783f00574d6d2cd2424e7eb3df3a57884420564ab8f733541e7ed01dacc591a370e4de326f