Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    102s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2024, 09:57

General

  • Target

    f6ab17b0d64817b6b8a692606a7abd90N.exe

  • Size

    512KB

  • MD5

    f6ab17b0d64817b6b8a692606a7abd90

  • SHA1

    047770fddd6b3077bcb66e3c00d3c7d517fcc81b

  • SHA256

    001c6b123d0ae6a0094635a2be4c7934c4acb04e4ef3b5947c702255f26f982d

  • SHA512

    7358fa82a75f254644087180d1198bc89dace7d89eed6b7e2e33c14ca0b7d12f77da3259a96d5a3e92641570ac136433b7869d983a2285b0865b155c99baa0a4

  • SSDEEP

    12288:S5DHplDngk0npM4dl0v5JHpS0wULVnMhysQ:S57ngkEM4dmv5Xf+E

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6ab17b0d64817b6b8a692606a7abd90N.exe
    "C:\Users\Admin\AppData\Local\Temp\f6ab17b0d64817b6b8a692606a7abd90N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 384
      2⤵
      • Program crash
      PID:5024
    • C:\Users\Admin\AppData\Local\Temp\f6ab17b0d64817b6b8a692606a7abd90N.exe
      C:\Users\Admin\AppData\Local\Temp\f6ab17b0d64817b6b8a692606a7abd90N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of UnmapMainImage
      PID:2316
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 364
        3⤵
        • Program crash
        PID:2712
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 768
        3⤵
        • Program crash
        PID:3440
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 788
        3⤵
        • Program crash
        PID:964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 2808
    1⤵
      PID:3140
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2316 -ip 2316
      1⤵
        PID:2416
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2316 -ip 2316
        1⤵
          PID:4872
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2316 -ip 2316
          1⤵
            PID:3868

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\f6ab17b0d64817b6b8a692606a7abd90N.exe

            Filesize

            512KB

            MD5

            75dc78389bd34ac8ac8ec0ec71eb6279

            SHA1

            41f4af2cf32123c5eb7038c6be880b0d3ba4fcf4

            SHA256

            0c3662a6c5f93e6c9c03909a9b34e948c1b2d8d97eeb071c79aefe427996f895

            SHA512

            9502d294cebe3440a7b17a66b49b6702c2d467c6e3a4d9885b2e1c21d5d5c422bcce7c91ca50015b6266385238f6dd7e0b5965c65f9649a7180c3802b114dc56

          • memory/2316-7-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2316-8-0x0000000004DC0000-0x0000000004DFE000-memory.dmp

            Filesize

            248KB

          • memory/2316-9-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

          • memory/2316-14-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2808-0-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB

          • memory/2808-6-0x0000000000400000-0x000000000043E000-memory.dmp

            Filesize

            248KB