Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    106s
  • max time network
    115s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 01:54

General

  • Target

    b4590f289b489e479a53f5d129d7d680N.exe

  • Size

    2.4MB

  • MD5

    b4590f289b489e479a53f5d129d7d680

  • SHA1

    c57d2d384719b9e5641a2155698fa1c5d0b2ca14

  • SHA256

    24926a53504430553bf27f241871c8a83ee8d4ca8f8d43d4038f98c6cce75ba9

  • SHA512

    bb92885a1ed5033d2a84b5b8e3c184516f6fab96a1d40fa102dc5128f5c1f3db40a7b2a92d907f14d5a2f197c7cee0dd603a6c5b9d7d4fdf833c7c7ecbcf7f7e

  • SSDEEP

    49152:MkRuZok21dkvQ7g7grNZbNsm+kwjI4TT86lorVlyR0Wx:l8ZR0mIjNZZshK4n86WrWDx

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Program crash 14 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b4590f289b489e479a53f5d129d7d680N.exe
    "C:\Users\Admin\AppData\Local\Temp\b4590f289b489e479a53f5d129d7d680N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 344
      2⤵
      • Program crash
      PID:544
    • C:\Users\Admin\AppData\Local\Temp\b4590f289b489e479a53f5d129d7d680N.exe
      C:\Users\Admin\AppData\Local\Temp\b4590f289b489e479a53f5d129d7d680N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:1784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 344
        3⤵
        • Program crash
        PID:4360
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 596
        3⤵
        • Program crash
        PID:2256
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 596
        3⤵
        • Program crash
        PID:1648
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 596
        3⤵
        • Program crash
        PID:3604
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 720
        3⤵
        • Program crash
        PID:2636
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 920
        3⤵
        • Program crash
        PID:4488
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1412
        3⤵
        • Program crash
        PID:636
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1456
        3⤵
        • Program crash
        PID:888
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1496
        3⤵
        • Program crash
        PID:456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1516
        3⤵
        • Program crash
        PID:2452
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1456
        3⤵
        • Program crash
        PID:1064
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1492
        3⤵
        • Program crash
        PID:1220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 1032
        3⤵
        • Program crash
        PID:2800
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2504 -ip 2504
    1⤵
      PID:4780
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1784 -ip 1784
      1⤵
        PID:2948
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1784 -ip 1784
        1⤵
          PID:316
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1784 -ip 1784
          1⤵
            PID:1668
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1784 -ip 1784
            1⤵
              PID:2412
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1784 -ip 1784
              1⤵
                PID:3484
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1784 -ip 1784
                1⤵
                  PID:4268
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1784 -ip 1784
                  1⤵
                    PID:1768
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1784 -ip 1784
                    1⤵
                      PID:4632
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1784 -ip 1784
                      1⤵
                        PID:1196
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1784 -ip 1784
                        1⤵
                          PID:4800
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1784 -ip 1784
                          1⤵
                            PID:1980
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1784 -ip 1784
                            1⤵
                              PID:452
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1784 -ip 1784
                              1⤵
                                PID:1500

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Temp\b4590f289b489e479a53f5d129d7d680N.exe

                                Filesize

                                2.4MB

                                MD5

                                4ed22e2427e8ada1994219f91714d3fe

                                SHA1

                                8ef265702eb2ca3e926d007fbfc3602dd2786dfa

                                SHA256

                                22cb89d6ec1a14d254aeadb1498adf895090d7293d1552ba61ea32786092a25f

                                SHA512

                                a23148bb7f935fdeec52f22ff96a736226010752327395d84f01a0fb77c441cc357763e8ec07e4edecccca60da60f517436e78f20941a36a5de316fbfac97355

                              • memory/1784-6-0x0000000000400000-0x0000000000517000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/1784-8-0x0000000005110000-0x0000000005227000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/1784-9-0x0000000000400000-0x00000000004A3000-memory.dmp

                                Filesize

                                652KB

                              • memory/1784-21-0x0000000000400000-0x0000000000443000-memory.dmp

                                Filesize

                                268KB

                              • memory/1784-27-0x000000000B7D0000-0x000000000B873000-memory.dmp

                                Filesize

                                652KB

                              • memory/1784-28-0x0000000000400000-0x0000000000517000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/2504-0-0x0000000000400000-0x0000000000517000-memory.dmp

                                Filesize

                                1.1MB

                              • memory/2504-7-0x0000000000400000-0x0000000000517000-memory.dmp

                                Filesize

                                1.1MB