Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 09:57
Static task
static1
Behavioral task
behavioral1
Sample
f6ab17b0d64817b6b8a692606a7abd90N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f6ab17b0d64817b6b8a692606a7abd90N.exe
Resource
win10v2004-20240802-en
General
-
Target
f6ab17b0d64817b6b8a692606a7abd90N.exe
-
Size
512KB
-
MD5
f6ab17b0d64817b6b8a692606a7abd90
-
SHA1
047770fddd6b3077bcb66e3c00d3c7d517fcc81b
-
SHA256
001c6b123d0ae6a0094635a2be4c7934c4acb04e4ef3b5947c702255f26f982d
-
SHA512
7358fa82a75f254644087180d1198bc89dace7d89eed6b7e2e33c14ca0b7d12f77da3259a96d5a3e92641570ac136433b7869d983a2285b0865b155c99baa0a4
-
SSDEEP
12288:S5DHplDngk0npM4dl0v5JHpS0wULVnMhysQ:S57ngkEM4dmv5Xf+E
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2316 f6ab17b0d64817b6b8a692606a7abd90N.exe -
Executes dropped EXE 1 IoCs
pid Process 2316 f6ab17b0d64817b6b8a692606a7abd90N.exe -
Program crash 4 IoCs
pid pid_target Process procid_target 5024 2808 WerFault.exe 83 2712 2316 WerFault.exe 90 3440 2316 WerFault.exe 90 964 2316 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6ab17b0d64817b6b8a692606a7abd90N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6ab17b0d64817b6b8a692606a7abd90N.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2808 f6ab17b0d64817b6b8a692606a7abd90N.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2316 f6ab17b0d64817b6b8a692606a7abd90N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2316 2808 f6ab17b0d64817b6b8a692606a7abd90N.exe 90 PID 2808 wrote to memory of 2316 2808 f6ab17b0d64817b6b8a692606a7abd90N.exe 90 PID 2808 wrote to memory of 2316 2808 f6ab17b0d64817b6b8a692606a7abd90N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6ab17b0d64817b6b8a692606a7abd90N.exe"C:\Users\Admin\AppData\Local\Temp\f6ab17b0d64817b6b8a692606a7abd90N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 3842⤵
- Program crash
PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\f6ab17b0d64817b6b8a692606a7abd90N.exeC:\Users\Admin\AppData\Local\Temp\f6ab17b0d64817b6b8a692606a7abd90N.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 3643⤵
- Program crash
PID:2712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 7683⤵
- Program crash
PID:3440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 7883⤵
- Program crash
PID:964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 28081⤵PID:3140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2316 -ip 23161⤵PID:2416
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2316 -ip 23161⤵PID:4872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2316 -ip 23161⤵PID:3868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD575dc78389bd34ac8ac8ec0ec71eb6279
SHA141f4af2cf32123c5eb7038c6be880b0d3ba4fcf4
SHA2560c3662a6c5f93e6c9c03909a9b34e948c1b2d8d97eeb071c79aefe427996f895
SHA5129502d294cebe3440a7b17a66b49b6702c2d467c6e3a4d9885b2e1c21d5d5c422bcce7c91ca50015b6266385238f6dd7e0b5965c65f9649a7180c3802b114dc56