Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe
Resource
win10v2004-20240802-en
General
-
Target
ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe
-
Size
668KB
-
MD5
a8b1effc8146d632047c98e1d0438726
-
SHA1
371b155aa0a4bae9a5d4ce7b0e8ae2207317ba51
-
SHA256
ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c
-
SHA512
b3cd388fb55f4a5c9c01130aea68984a2e98feead2fae1d8ebec029a27a181614d36141b35c3e349e5073a03b1c596dd50e43578982a0fdafe9cdf0e07ed5223
-
SSDEEP
12288:VtR+1bcjbH1ddB8NZX3nLlJDHUVQ5zCN2j6FB5WMlL143VQ5zCSjdgEi0kXz:Ho1bc/HToLlJDHUVQ5zg2mblLO3VQ5zC
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4720 ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe -
Executes dropped EXE 1 IoCs
pid Process 4720 ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 3748 1776 WerFault.exe 83 844 4720 WerFault.exe 91 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1776 ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4720 ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1776 wrote to memory of 4720 1776 ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe 91 PID 1776 wrote to memory of 4720 1776 ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe 91 PID 1776 wrote to memory of 4720 1776 ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe"C:\Users\Admin\AppData\Local\Temp\ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 3962⤵
- Program crash
PID:3748
-
-
C:\Users\Admin\AppData\Local\Temp\ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exeC:\Users\Admin\AppData\Local\Temp\ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4720 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 3643⤵
- Program crash
PID:844
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1776 -ip 17761⤵PID:3200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4720 -ip 47201⤵PID:2196
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ceb88a902c84034ced82c3583bc0b5240fe3d7a3ed6534d00b08cfee10c1df0c.exe
Filesize668KB
MD5d0ce02b27b70ab7ce58ef2a439bbf6bd
SHA15978ac55aef39ba3a035c8b5feda0a98b4ba51f3
SHA256276d90fbe60bbca7274ddadb4d82ee4b38620ac38a0fcf5cf7b265091a81c73f
SHA5122391af7266e8c0859feea9a8a748087c2e444961ff3d5c4ac857996c11536f1346c3d79836c95fa262187a18e3d3b0f71249178eb76b3c83478501e05c80f0aa