Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 16:56
Static task
static1
Behavioral task
behavioral1
Sample
5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe
Resource
win10v2004-20240508-en
General
-
Target
5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe
-
Size
491KB
-
MD5
13b2bc3048a18cdd25de8e3449db2d5c
-
SHA1
875751b8aa356540e60b2ce80b9ccae2b84523e4
-
SHA256
5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f
-
SHA512
db7ab32acde9409838c517ede93026a65df572ad46455284a703a7b6524c16a5b2473b9c0f0e41323f757d98df16b393cb6f6d86edcda02b0c1ff022c1ae8fdf
-
SSDEEP
6144:ZQmLJe2lRMI3SLuyvO81jbQRViKT+UePVBnODIJm+8/aGAAzUCeiEU+SSSSSSSxC:emdTzCL1vBjkViKT+U6FOcJ5uoCeqVK
Malware Config
Extracted
amadey
4.21
b2c2c1
http://greendag.ru
-
install_dir
e221f72865
-
install_file
Dctooux.exe
-
strings_key
09a7af7983af08af50ea3f51a73065e9
-
url_paths
/forum/index.php
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe -
Executes dropped EXE 2 IoCs
pid Process 2204 Dctooux.exe 2232 Dctooux.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Dctooux.job 5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 27 IoCs
pid pid_target Process procid_target 3152 620 WerFault.exe 81 4860 620 WerFault.exe 81 2068 620 WerFault.exe 81 2476 620 WerFault.exe 81 4584 620 WerFault.exe 81 1668 620 WerFault.exe 81 4632 620 WerFault.exe 81 4524 620 WerFault.exe 81 4412 620 WerFault.exe 81 1368 620 WerFault.exe 81 4732 2204 WerFault.exe 107 4548 2232 WerFault.exe 117 1608 2232 WerFault.exe 117 4228 2232 WerFault.exe 117 3288 2232 WerFault.exe 117 3428 2232 WerFault.exe 117 1612 2232 WerFault.exe 117 5048 2232 WerFault.exe 117 3056 2232 WerFault.exe 117 8 2232 WerFault.exe 117 2192 2232 WerFault.exe 117 4724 2232 WerFault.exe 117 804 2232 WerFault.exe 117 1932 2232 WerFault.exe 117 3324 2232 WerFault.exe 117 2488 2232 WerFault.exe 117 4424 2232 WerFault.exe 117 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 620 5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 620 wrote to memory of 2204 620 5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe 107 PID 620 wrote to memory of 2204 620 5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe 107 PID 620 wrote to memory of 2204 620 5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe"C:\Users\Admin\AppData\Local\Temp\5fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 7562⤵
- Program crash
PID:3152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 8282⤵
- Program crash
PID:4860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 8562⤵
- Program crash
PID:2068
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 8642⤵
- Program crash
PID:2476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 9122⤵
- Program crash
PID:4584
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 8682⤵
- Program crash
PID:1668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 11122⤵
- Program crash
PID:4632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 11122⤵
- Program crash
PID:4524
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 12362⤵
- Program crash
PID:4412
-
-
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe"2⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 4723⤵
- Program crash
PID:4732
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 12802⤵
- Program crash
PID:1368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 620 -ip 6201⤵PID:3972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 620 -ip 6201⤵PID:4024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 620 -ip 6201⤵PID:3628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 620 -ip 6201⤵PID:1008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 620 -ip 6201⤵PID:2768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 620 -ip 6201⤵PID:3868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 620 -ip 6201⤵PID:4840
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 620 -ip 6201⤵PID:2436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 620 -ip 6201⤵PID:1944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 620 -ip 6201⤵PID:4684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2204 -ip 22041⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exeC:\Users\Admin\AppData\Local\Temp\e221f72865\Dctooux.exe1⤵
- Executes dropped EXE
PID:2232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 5282⤵
- Program crash
PID:4548
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 5682⤵
- Program crash
PID:1608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 5722⤵
- Program crash
PID:4228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 5922⤵
- Program crash
PID:3288
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 7002⤵
- Program crash
PID:3428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 8122⤵
- Program crash
PID:1612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 8602⤵
- Program crash
PID:5048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 8122⤵
- Program crash
PID:3056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 8122⤵
- Program crash
PID:8
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 8962⤵
- Program crash
PID:2192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 9882⤵
- Program crash
PID:4724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 11282⤵
- Program crash
PID:804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 9922⤵
- Program crash
PID:1932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 14082⤵
- Program crash
PID:3324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 11522⤵
- Program crash
PID:2488
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 14602⤵
- Program crash
PID:4424
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2232 -ip 22321⤵PID:4460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2232 -ip 22321⤵PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2232 -ip 22321⤵PID:2708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2232 -ip 22321⤵PID:3864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2232 -ip 22321⤵PID:3152
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2232 -ip 22321⤵PID:2056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2232 -ip 22321⤵PID:464
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2232 -ip 22321⤵PID:5096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2232 -ip 22321⤵PID:1308
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2232 -ip 22321⤵PID:4672
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2232 -ip 22321⤵PID:2812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2232 -ip 22321⤵PID:3676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2232 -ip 22321⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2232 -ip 22321⤵PID:4320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2232 -ip 22321⤵PID:3400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2232 -ip 22321⤵PID:2112
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5eb6b213deac2d232db199ce122176dbf
SHA1cb88caacb68415c9f5aea39cc22c340c447a7f4d
SHA256c7edc9dc10fce17033fc742c16d623fb2fb054e638c9dd38b59bdc420389067d
SHA5128c62f01d459f554eef7b8112fcb24008c1b32726700ca5fba27348cc551d905e6a4fb4063a3e6f07a5bca004ddd7fe8154712ba3730db7ffb668d35518d5f6f2
-
Filesize
491KB
MD513b2bc3048a18cdd25de8e3449db2d5c
SHA1875751b8aa356540e60b2ce80b9ccae2b84523e4
SHA2565fef337b6a0d347e4ba1d05ae695c4af0ebd6bdf22ba85c544fc839473ed350f
SHA512db7ab32acde9409838c517ede93026a65df572ad46455284a703a7b6524c16a5b2473b9c0f0e41323f757d98df16b393cb6f6d86edcda02b0c1ff022c1ae8fdf