Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/06/2024, 15:31
Static task
static1
Behavioral task
behavioral1
Sample
c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149.exe
Resource
win10v2004-20240508-en
General
-
Target
c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149.exe
-
Size
490KB
-
MD5
aa105c47c9f55f1333551c42a1a8f82a
-
SHA1
e7aaf771310ba0d44ff6dad1fdbffc274e35e0af
-
SHA256
c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149
-
SHA512
b161c6407a69f074310f2af1760150beceac281e12536e6eb43dfb429876022292ae704b24469de3feb05c7888c0d329df724f16488252a0f1835db92ccf29f6
-
SSDEEP
6144:x2bLFjBLhbyak4ojdAPCFICEZJzLxfS1SZ+JAdC0qd8VePUTgY4cXc6:CRjBFjojIZdZJzI1jAA0qd8o8Tgz
Malware Config
Extracted
amadey
4.19
8fc809
http://nudump.com
http://otyt.ru
http://selltix.org
-
install_dir
b739b37d80
-
install_file
Dctooux.exe
-
strings_key
65bac8d4c26069c29f1fd276f7af33f3
-
url_paths
/forum/index.php
/forum2/index.php
/forum3/index.php
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2036 Dctooux.exe 984 Dctooux.exe 2948 Dctooux.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Dctooux.job c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 33 IoCs
pid pid_target Process procid_target 4896 1516 WerFault.exe 77 3572 1516 WerFault.exe 77 1572 1516 WerFault.exe 77 1296 1516 WerFault.exe 77 2844 1516 WerFault.exe 77 4496 1516 WerFault.exe 77 4908 1516 WerFault.exe 77 3212 1516 WerFault.exe 77 3820 1516 WerFault.exe 77 424 1516 WerFault.exe 77 2208 1516 WerFault.exe 77 4460 2036 WerFault.exe 99 916 2036 WerFault.exe 99 4944 2036 WerFault.exe 99 2352 2036 WerFault.exe 99 1820 2036 WerFault.exe 99 4536 2036 WerFault.exe 99 3196 2036 WerFault.exe 99 896 2036 WerFault.exe 99 3380 2036 WerFault.exe 99 3900 2036 WerFault.exe 99 1140 2036 WerFault.exe 99 2200 2036 WerFault.exe 99 1752 2036 WerFault.exe 99 3944 2036 WerFault.exe 99 1040 2036 WerFault.exe 99 4996 2036 WerFault.exe 99 4604 2036 WerFault.exe 99 4124 2036 WerFault.exe 99 3176 984 WerFault.exe 139 1412 2036 WerFault.exe 99 1260 2948 WerFault.exe 144 2068 2036 WerFault.exe 99 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1516 c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1516 wrote to memory of 2036 1516 c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149.exe 99 PID 1516 wrote to memory of 2036 1516 c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149.exe 99 PID 1516 wrote to memory of 2036 1516 c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149.exe"C:\Users\Admin\AppData\Local\Temp\c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149.exe"1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 7802⤵
- Program crash
PID:4896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 7962⤵
- Program crash
PID:3572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 8402⤵
- Program crash
PID:1572
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 8442⤵
- Program crash
PID:1296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 9242⤵
- Program crash
PID:2844
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 9682⤵
- Program crash
PID:4496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 10202⤵
- Program crash
PID:4908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 10402⤵
- Program crash
PID:3212
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 11362⤵
- Program crash
PID:3820
-
-
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"2⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 5923⤵
- Program crash
PID:4460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 6323⤵
- Program crash
PID:916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 6603⤵
- Program crash
PID:4944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 6443⤵
- Program crash
PID:2352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 7363⤵
- Program crash
PID:1820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 7683⤵
- Program crash
PID:4536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 9043⤵
- Program crash
PID:3196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 8283⤵
- Program crash
PID:896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 9563⤵
- Program crash
PID:3380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 9763⤵
- Program crash
PID:3900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 10083⤵
- Program crash
PID:1140
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 10683⤵
- Program crash
PID:2200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 12323⤵
- Program crash
PID:1752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 14443⤵
- Program crash
PID:3944
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 15043⤵
- Program crash
PID:1040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 15243⤵
- Program crash
PID:4996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 15683⤵
- Program crash
PID:4604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 15723⤵
- Program crash
PID:4124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 5403⤵
- Program crash
PID:1412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 9083⤵
- Program crash
PID:2068
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 15722⤵
- Program crash
PID:424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 15802⤵
- Program crash
PID:2208
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 1516 -ip 15161⤵PID:620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1516 -ip 15161⤵PID:4548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1516 -ip 15161⤵PID:4112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1516 -ip 15161⤵PID:952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1516 -ip 15161⤵PID:1920
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1516 -ip 15161⤵PID:4448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1516 -ip 15161⤵PID:5008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1516 -ip 15161⤵PID:3768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1516 -ip 15161⤵PID:2232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1516 -ip 15161⤵PID:1708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1516 -ip 15161⤵PID:4720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2036 -ip 20361⤵PID:2216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2036 -ip 20361⤵PID:1260
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2036 -ip 20361⤵PID:1892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2036 -ip 20361⤵PID:4064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2036 -ip 20361⤵PID:4052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2036 -ip 20361⤵PID:1932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2036 -ip 20361⤵PID:3748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2036 -ip 20361⤵PID:4504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2036 -ip 20361⤵PID:1912
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2036 -ip 20361⤵PID:1712
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2036 -ip 20361⤵PID:2280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2036 -ip 20361⤵PID:2448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2036 -ip 20361⤵PID:1908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2036 -ip 20361⤵PID:2560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2036 -ip 20361⤵PID:3112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2036 -ip 20361⤵PID:836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2036 -ip 20361⤵PID:4664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2036 -ip 20361⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe1⤵
- Executes dropped EXE
PID:984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 4762⤵
- Program crash
PID:3176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 984 -ip 9841⤵PID:4856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2036 -ip 20361⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe1⤵
- Executes dropped EXE
PID:2948 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 4762⤵
- Program crash
PID:1260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2948 -ip 29481⤵PID:2812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2036 -ip 20361⤵PID:4588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD587226658219e628170a425eef8a5c80a
SHA107a0759b460c599d2cffe53298e969b4b87d39df
SHA2566dff14d0e576879a5455fe04aaad96ae4a0b5792ee05e8ff09c632577a37e71b
SHA51279327698df0726535bf0383f0e2fd037fc43efa0925a9a3f6321c841096c8d9d5ccb4d89f667cde4ce483097412aa569a261455b989189c627ae9050979d82f2
-
Filesize
490KB
MD5aa105c47c9f55f1333551c42a1a8f82a
SHA1e7aaf771310ba0d44ff6dad1fdbffc274e35e0af
SHA256c91c6d8e93ba56cf0398a409f6c7d3bc599afd4a977a55f7dc682bebdffa8149
SHA512b161c6407a69f074310f2af1760150beceac281e12536e6eb43dfb429876022292ae704b24469de3feb05c7888c0d329df724f16488252a0f1835db92ccf29f6
-
Filesize
153B
MD5d47b646093dd84d34885a714ce4bd74e
SHA1c4df23671b6440e29159093dc52cb8c4aa184597
SHA2566807c84bf35d67496e020c1528303b87d4759933c09817e514a7159ac689d352
SHA512906fb89d5ec9dc4338f9d5e26fdc9ccc041225157a8f114465449106128d69e9fbc7723b2bcdd56a17c74c29983f7126a1d970b24e3902a3c4e817834f21f338