Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
20/06/2024, 01:10
Static task
static1
Behavioral task
behavioral1
Sample
32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd.exe
Resource
win10v2004-20240611-en
General
-
Target
32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd.exe
-
Size
581KB
-
MD5
d52303578c29640c6b02ac49a2075ad3
-
SHA1
be0f1d767f91be2e7a9e1d89ab58a34f601a279b
-
SHA256
32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd
-
SHA512
eec7136a6f29fde81bbaefbcac93e8234b5217928330862e2eae12162aec871c679d0a283095942e9d70c5d5f22691d0555c3b1e187ba06abb43fc3a89dd61e6
-
SSDEEP
12288:3Ny16BJzpPPQlR/wKBZbDVuQIcQ7YdSR5Y4F1V799C:d1JzpwlRoKbQ7oSRqqH79o
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1604 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\kobberbrylluppers.dis 32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\Protoplasmaet.ini 32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2852 1604 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1604 powershell.exe 1604 powershell.exe 1604 powershell.exe 1604 powershell.exe 1604 powershell.exe 1604 powershell.exe 1604 powershell.exe 1604 powershell.exe 1604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1604 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3596 wrote to memory of 1604 3596 32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd.exe 84 PID 3596 wrote to memory of 1604 3596 32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd.exe 84 PID 3596 wrote to memory of 1604 3596 32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd.exe 84 PID 1604 wrote to memory of 4948 1604 powershell.exe 88 PID 1604 wrote to memory of 4948 1604 powershell.exe 88 PID 1604 wrote to memory of 4948 1604 powershell.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd.exe"C:\Users\Admin\AppData\Local\Temp\32eb98f1f7ac1afbb6973567bbb44da961ac9a34e81900878c7170a1099a82bd.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Micropenis247=Get-Content 'C:\Users\Admin\AppData\Local\gannetry\Salle.Non';$Appellerede=$Micropenis247.SubString(68777,3);.$Appellerede($Micropenis247)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "/c set /A 1^^0"3⤵PID:4948
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 25683⤵
- Program crash
PID:2852
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1604 -ip 16041⤵PID:996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
67KB
MD51597abb9389a3dc50e280f8c2e1a4cff
SHA1bbfac48e35c19284cc3431a40c1519beb854a250
SHA256aa36dfd548ae2c29a2bcd2aa2613e4e6bedebfb70536b778a5b65048eff8e94e
SHA51274ee87b4bc669acd7a3c2f640760b0c688e6a2f3b2b1d9870bcf14c87ed6d0d0d93e850170edf6240d2d52401e36fee92dccf2b6de611ebf6bd349df5a529517