Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

b76461cc2c...0N.exe

windows7-x64

8

b76461cc2c...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    115s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 14:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b76461cc2cd642f4dc9be8dd78eee130N.exe

  • Size

    704KB

  • MD5

    b76461cc2cd642f4dc9be8dd78eee130

  • SHA1

    3fd71ad4dfdc16daca1749fe7ab5e677cf3824ea

  • SHA256

    0fbe8246924efb4a2214b064cfda8cb98069aaee7af1e68311f941bc21c17190

  • SHA512

    d0556a4cfec0270a17537182a56b2744c5eed177ce66d91d3b85a4aedbc907ae29edc7c1818602060535164fdf4623d1ba4f3866d1981f625b8a2aa4b36cf1af

  • SSDEEP

    12288:3QwY/2067WhaCjx1wp70f1k6muIut8iqWrrckBsMtinswNvA3wpVU0gr:a6rc1wuf1kBuIuGiqyFtifFu

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Program crash 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 37 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b76461cc2cd642f4dc9be8dd78eee130N.exe
    "C:\Users\Admin\AppData\Local\Temp\b76461cc2cd642f4dc9be8dd78eee130N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3648 -s 364
      2⤵
      • Program crash
      PID:1980
    • C:\Users\Admin\AppData\Local\Temp\b76461cc2cd642f4dc9be8dd78eee130N.exe
      C:\Users\Admin\AppData\Local\Temp\b76461cc2cd642f4dc9be8dd78eee130N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • System policy modification
      PID:5012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 332
        3⤵
        • Program crash
        PID:624
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 668
        3⤵
        • Program crash
        PID:1392
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 792
        3⤵
        • Program crash
        PID:3928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 828
        3⤵
        • Program crash
        PID:3536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 928
        3⤵
        • Program crash
        PID:3292
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 968
        3⤵
        • Program crash
        PID:4660
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 964
        3⤵
        • Program crash
        PID:4028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 1256
        3⤵
        • Program crash
        PID:1640
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3648 -ip 3648
    1⤵
      PID:4052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5012 -ip 5012
      1⤵
        PID:1528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5012 -ip 5012
        1⤵
          PID:2336
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5012 -ip 5012
          1⤵
            PID:2736
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5012 -ip 5012
            1⤵
              PID:3468
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5012 -ip 5012
              1⤵
                PID:2120
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5012 -ip 5012
                1⤵
                  PID:4328
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5012 -ip 5012
                  1⤵
                    PID:4040
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5012 -ip 5012
                    1⤵
                      PID:2428
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:2508
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Modifies registry class
                        PID:1896
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:800
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                      1⤵
                      • Suspicious behavior: AddClipboardFormatListener
                      PID:4524
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                      1⤵
                        PID:4640
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:2088
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:1220
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                        1⤵
                          PID:452

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133674268778711726.txt
                          Filesize

                          74KB

                          MD5

                          4439e73b6140d21baf0a7e1cdfb87ad9

                          SHA1

                          c91b6159615b93aa86c4c45548899f908b65c058

                          SHA256

                          80987e959689f2d7f6395fe11bb78d16e762f6769f893519da6ebb4b7eb107ae

                          SHA512

                          27287135da96b71805ba808f357e1d2df42c137956c546fbb16900bc33b464b7f9c44adc6f33dc9f42d9a19eabb9f8eb6399c0227dc5a73bfc3a3a632ef39d79

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\b76461cc2cd642f4dc9be8dd78eee130N.exe
                          Filesize

                          704KB

                          MD5

                          b6b9465d5c8841dab9ab82d65dbd5783

                          SHA1

                          4667b74464aad44c7b84420245e1cd758a254433

                          SHA256

                          2bdc70db5d387a2cca162efc17d5ec5a9683a374d336c372c9a656af1d98f928

                          SHA512

                          be37555314bb601044d229ba2cb821c328b894bb0e2c70a846dd2c225c5852ca39b42b4ac2ae51625e50d9727f239dba4c11be1d0bafff822afaa79dc176dd93

                          Download Submit

                        • memory/800-27-0x0000000002830000-0x0000000002831000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1220-30-0x000002AC73E00000-0x000002AC73F00000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/1220-29-0x000002AC73E00000-0x000002AC73F00000-memory.dmp

                          Filesize

                          1024KB

                          Download

                        • memory/1220-41-0x000002AC74C60000-0x000002AC74C80000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/1220-51-0x000002AC75280000-0x000002AC752A0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/1220-34-0x000002AC74CA0000-0x000002AC74CC0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3648-6-0x0000000000400000-0x0000000000472000-memory.dmp

                          Filesize

                          456KB

                          Download

                        • memory/3648-0-0x0000000000400000-0x0000000000472000-memory.dmp

                          Filesize

                          456KB

                          Download

                        • memory/5012-8-0x0000000000400000-0x000000000045A000-memory.dmp

                          Filesize

                          360KB

                          Download

                        • memory/5012-25-0x0000000000400000-0x000000000045A000-memory.dmp

                          Filesize

                          360KB

                          Download

                        • memory/5012-16-0x0000000000400000-0x000000000045A000-memory.dmp

                          Filesize

                          360KB

                          Download

                        • memory/5012-15-0x0000000000470000-0x0000000000471000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/5012-14-0x0000000000180000-0x00000000001F2000-memory.dmp

                          Filesize

                          456KB

                          Download

                        • memory/5012-7-0x0000000000400000-0x0000000000472000-memory.dmp

                          Filesize

                          456KB

                          Download