Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2024, 06:43
Behavioral task
behavioral1
Sample
5a94bd63f57bec97c51003f347ef5d70N.exe
Resource
win7-20240705-en
General
-
Target
5a94bd63f57bec97c51003f347ef5d70N.exe
-
Size
1003KB
-
MD5
5a94bd63f57bec97c51003f347ef5d70
-
SHA1
c0ad28860a7ad21587d6237c221c07eb9fb63536
-
SHA256
da8dcb598c0f52af571ccee448f54a3b4dcf3bd13df39db80751ef02dc7f4fd8
-
SHA512
0e1219e67fd645bdaac5fe9b7e7d79455478b27f5852416d634b2277f30766818fde11f61f69b7816d240f7595aeb81e7eeeb1e0a2a5765e970cebe233023ef5
-
SSDEEP
24576:Af9Nn/0eyTwFf3HJEuMlSVj21RaBkoXlq:AlV/0fwFf3HJEuMlSVj21RaBkoXl
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1660 5a94bd63f57bec97c51003f347ef5d70N.exe -
Executes dropped EXE 1 IoCs
pid Process 1660 5a94bd63f57bec97c51003f347ef5d70N.exe -
resource yara_rule behavioral2/memory/2820-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral2/files/0x00080000000234af-12.dat upx behavioral2/memory/1660-14-0x0000000000400000-0x000000000065C000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 17 pastebin.com -
Program crash 19 IoCs
pid pid_target Process procid_target 1116 1660 WerFault.exe 86 4316 1660 WerFault.exe 86 1396 1660 WerFault.exe 86 4456 1660 WerFault.exe 86 4752 1660 WerFault.exe 86 4080 1660 WerFault.exe 86 4348 1660 WerFault.exe 86 2404 1660 WerFault.exe 86 2320 1660 WerFault.exe 86 1004 1660 WerFault.exe 86 2168 1660 WerFault.exe 86 1900 1660 WerFault.exe 86 868 1660 WerFault.exe 86 2704 1660 WerFault.exe 86 216 1660 WerFault.exe 86 116 1660 WerFault.exe 86 3320 1660 WerFault.exe 86 1172 1660 WerFault.exe 86 1468 1660 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5a94bd63f57bec97c51003f347ef5d70N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5a94bd63f57bec97c51003f347ef5d70N.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 780 schtasks.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2820 5a94bd63f57bec97c51003f347ef5d70N.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2820 5a94bd63f57bec97c51003f347ef5d70N.exe 1660 5a94bd63f57bec97c51003f347ef5d70N.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2820 wrote to memory of 1660 2820 5a94bd63f57bec97c51003f347ef5d70N.exe 86 PID 2820 wrote to memory of 1660 2820 5a94bd63f57bec97c51003f347ef5d70N.exe 86 PID 2820 wrote to memory of 1660 2820 5a94bd63f57bec97c51003f347ef5d70N.exe 86 PID 1660 wrote to memory of 780 1660 5a94bd63f57bec97c51003f347ef5d70N.exe 87 PID 1660 wrote to memory of 780 1660 5a94bd63f57bec97c51003f347ef5d70N.exe 87 PID 1660 wrote to memory of 780 1660 5a94bd63f57bec97c51003f347ef5d70N.exe 87 PID 1660 wrote to memory of 1412 1660 5a94bd63f57bec97c51003f347ef5d70N.exe 89 PID 1660 wrote to memory of 1412 1660 5a94bd63f57bec97c51003f347ef5d70N.exe 89 PID 1660 wrote to memory of 1412 1660 5a94bd63f57bec97c51003f347ef5d70N.exe 89 PID 1412 wrote to memory of 3256 1412 cmd.exe 91 PID 1412 wrote to memory of 3256 1412 cmd.exe 91 PID 1412 wrote to memory of 3256 1412 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a94bd63f57bec97c51003f347ef5d70N.exe"C:\Users\Admin\AppData\Local\Temp\5a94bd63f57bec97c51003f347ef5d70N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5a94bd63f57bec97c51003f347ef5d70N.exeC:\Users\Admin\AppData\Local\Temp\5a94bd63f57bec97c51003f347ef5d70N.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\5a94bd63f57bec97c51003f347ef5d70N.exe" /TN n3TzfEYb35ee /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:780
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN n3TzfEYb35ee > C:\Users\Admin\AppData\Local\Temp\qI1KY.xml3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN n3TzfEYb35ee4⤵
- System Location Discovery: System Language Discovery
PID:3256
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 6083⤵
- Program crash
PID:1116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 6283⤵
- Program crash
PID:4316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 7363⤵
- Program crash
PID:1396
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 7083⤵
- Program crash
PID:4456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 7403⤵
- Program crash
PID:4752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 7923⤵
- Program crash
PID:4080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 14723⤵
- Program crash
PID:4348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 14843⤵
- Program crash
PID:2404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 17443⤵
- Program crash
PID:2320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 15763⤵
- Program crash
PID:1004
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 14963⤵
- Program crash
PID:2168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 14803⤵
- Program crash
PID:1900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 17803⤵
- Program crash
PID:868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 17403⤵
- Program crash
PID:2704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 17243⤵
- Program crash
PID:216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 17203⤵
- Program crash
PID:116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 18323⤵
- Program crash
PID:3320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 18163⤵
- Program crash
PID:1172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 15723⤵
- Program crash
PID:1468
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1660 -ip 16601⤵PID:1652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1660 -ip 16601⤵PID:1096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1660 -ip 16601⤵PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1660 -ip 16601⤵PID:1944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1660 -ip 16601⤵PID:3788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1660 -ip 16601⤵PID:3172
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1660 -ip 16601⤵PID:4232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1660 -ip 16601⤵PID:4112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1660 -ip 16601⤵PID:2500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1660 -ip 16601⤵PID:1760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1660 -ip 16601⤵PID:4312
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1660 -ip 16601⤵PID:1636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1660 -ip 16601⤵PID:316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1660 -ip 16601⤵PID:4932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1660 -ip 16601⤵PID:2436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1660 -ip 16601⤵PID:1432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1660 -ip 16601⤵PID:780
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1660 -ip 16601⤵PID:3296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1660 -ip 16601⤵PID:3708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1003KB
MD52170835cf77407df54c9b01c0ecc5d04
SHA19a6e556d3574b4108e11c6ad09e79a977441e556
SHA256310b63ae864dc82ac4b987a870cebc41139bda1d5d543f3e8d7f9300d3a80707
SHA5121004d630de203332ff0fed4100104073f020c27bc050126d500187cbe2f41d84d06b54969b56b1a2180691b5e96d9342ee8728bcf7c0813d30219353efc8b223
-
Filesize
1KB
MD50afd84c13e808d5db233383fbd75fe69
SHA15f3bf2f5e0c924422d760c8d48c9e2bddb5b8bff
SHA256a35970effb07d9ca455ce1641df76cd2e4a75a964a841ac0eebef57939943b0c
SHA512fc114d1e1f6c66cad867402b9899444a5b76bdb6da1e6612345b6c364545259b5fd08b57df8e080b2e4cfe0539dfc51d095c4edb40d924ce1011da275ce743a0