Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3MalwareBazaar.exe
windows7-x64
10MalwareBazaar.exe
windows10-2004-x64
8$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 09:05
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
MalwareBazaar.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240709-en
General
-
Target
MalwareBazaar.exe
-
Size
484KB
-
MD5
4d5aa2285d7426050f478210bae7c5aa
-
SHA1
54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96
-
SHA256
9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124
-
SHA512
e5373e2e7201d31f26a41766606bc03f306ee7386b850ba9cfe27facf6b92b80ab3503218febda706ac428bd17d048ebaec83392acc17f55043edb830844d151
-
SSDEEP
12288:R0NwzBmcW5C5E3FRSnknkt7PY4vgxCZ+5JOwxyU3Bb/:fzwchGVRFktENxCZMtRD
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3764 powershell.exe -
Loads dropped DLL 4 IoCs
pid Process 948 MalwareBazaar.exe 948 MalwareBazaar.exe 948 MalwareBazaar.exe 948 MalwareBazaar.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3152 3764 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 3764 powershell.exe 3764 powershell.exe 3764 powershell.exe 3764 powershell.exe 3764 powershell.exe 3764 powershell.exe 3764 powershell.exe 3764 powershell.exe 3764 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3764 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 948 wrote to memory of 3764 948 MalwareBazaar.exe 84 PID 948 wrote to memory of 3764 948 MalwareBazaar.exe 84 PID 948 wrote to memory of 3764 948 MalwareBazaar.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Diffusibleness=Get-Content 'C:\Users\Admin\AppData\Local\kilns\Unobtainably\Gyldigheden146.Aga';$Bimana=$Diffusibleness.SubString(14599,3);.$Bimana($Diffusibleness)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3764 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 24803⤵
- Program crash
PID:3152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3764 -ip 37641⤵PID:4592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
7KB
MD5521df745a41f0b8164ffd01717cacbba
SHA1dc7a9eacfbeb1fae52091da5e80db6cb1b6bce74
SHA256dbf91707fa157603bea025a6411cdcb497ab11262c9c18b14dc431a45aa17c0b
SHA512c5b1ba062872a8f534e2f0eac57fc3c0d8be9cda79605d86566d67260ba5477444a0ddfed1838b4fb14c677e5342c8419a88fcd38147dbaa36ac1f9e00c52bbe
-
Filesize
4KB
MD5acbda33dd5700c122e2fe48e3d4351fd
SHA12c154baf7c64052ee712b7cdf9c36b7697dd3fc8
SHA256943b33829f9013e4d361482a5c8981ba20a7155c78691dbe02a8f8cd2a02efa0
SHA512d090adf65a74ac5b910b18bb67e989714335e7b4778cd771cff154d7186351a1bebbc7103cca849bdfa2709c991947ffff6c1d8fdf16a74f4dfb614bce3ff6fd
-
Filesize
9KB
MD51c8b2b40c642e8b5a5b3ff102796fb37
SHA13245f55afac50f775eb53fd6d14abb7fe523393d
SHA2568780095aa2f49725388cddf00d79a74e85c9c4863b366f55c39c606a5fb8440c
SHA5124ff2dc83f640933162ec8818bb1bf3b3be1183264750946a3d949d2e7068ee606277b6c840193ef2b4663952387f07f6ab12c84c4a11cae9a8de7bd4e7971c57
-
Filesize
69KB
MD5d0a9e32e46f506f297ac08b6f2f12642
SHA1eede417b23afdc7dd7f1b8c4a1368f2495c619a2
SHA2566ff0b96b411fa1248bf9526086106e1a03ece0800f175a490f5cd3f83f9547d7
SHA5122bb7f65278ee1bb772e44294ccf7a388d0312487bc481d7c0af8d6eefcaa6ecef7855e9e0dd282fad12bcdd8a68059ed3c68c3790f4220fe11019087f052178a