Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/08/2024, 04:47
240806-fewxqstfrb 1006/08/2024, 04:46
240806-fedq6azenp 1006/08/2024, 04:44
240806-fc8thszeln 1005/08/2024, 13:30
240805-qr3ads1elc 10Analysis
-
max time kernel
94s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 13:30
Behavioral task
behavioral1
Sample
Avira Advertising/payment and key.exe
Resource
win7-20240705-en
General
-
Target
Avira Advertising/payment and key.exe
-
Size
4.2MB
-
MD5
ad433332d168ed1555d260e6b149e2fe
-
SHA1
beb4d3f2d7a8d2b4b194e7c123477010ea1a6baa
-
SHA256
7232ec3f17f009b1d24f7383d32a4b499288b000d5738758da0035252953e409
-
SHA512
bc4bd97db41debe9615d33a31b852f44c89b6ac43104241427f7ed742e771cc2ce590c583859e5368f2fd1e4c1b4ae57827a90ba1c095c76f0f2bc04857d8d92
-
SSDEEP
24576:h5yHx5/mc9iNTGYARvoqY6nNdcDMdvnLD4WlYrRkcXV7G4OVnw0cLOV:hIxcS8AY6nILfr
Malware Config
Extracted
lumma
https://empiredzmwnx.shop/api
https://boattyownerwrv.shop/api
https://rainbowmynsjn.shop/api
https://definitonizmnx.shop/api
https://creepydxzoxmj.shop/api
https://budgetttysnzm.shop/api
https://chippyfroggsyhz.shop/api
https://assumedtribsosp.shop/api
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3368 乇剒䵁乇䅁䕈 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3856 set thread context of 3368 3856 payment and key.exe 85 -
Program crash 1 IoCs
pid pid_target Process procid_target 4776 3368 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 乇剒䵁乇䅁䕈 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3856 wrote to memory of 3368 3856 payment and key.exe 85 PID 3856 wrote to memory of 3368 3856 payment and key.exe 85 PID 3856 wrote to memory of 3368 3856 payment and key.exe 85 PID 3856 wrote to memory of 3368 3856 payment and key.exe 85 PID 3856 wrote to memory of 3368 3856 payment and key.exe 85 PID 3856 wrote to memory of 3368 3856 payment and key.exe 85 PID 3856 wrote to memory of 3368 3856 payment and key.exe 85 PID 3856 wrote to memory of 3368 3856 payment and key.exe 85 PID 3856 wrote to memory of 3368 3856 payment and key.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Avira Advertising\payment and key.exe"C:\Users\Admin\AppData\Local\Temp\Avira Advertising\payment and key.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\乇剒䵁乇䅁䕈"C:\Users\Admin\AppData\Local\Temp\乇剒䵁乇䅁䕈"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3368 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 3723⤵
- Program crash
PID:4776
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3368 -ip 33681⤵PID:2544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD53992f464696b0eeff236aef93b1fdbd5
SHA18dddabaea6b342efc4f5b244420a0af055ae691e
SHA2560d1a8457014f2eb2563a91d1509dba38f6c418fedf5f241d8579d15a93e40e14
SHA51227a63b43dc50faf4d9b06e10daa15e83dfb3f3be1bd3af83ea6990bd8ae6d3a6a7fc2f928822db972aaf1305970f4587d768d68cd7e1124bc8f710c1d3ee19a6