Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2024, 11:03
Static task
static1
Behavioral task
behavioral1
Sample
0eaf2f04892df638d00d54cbfe5e9970N.exe
Resource
win7-20240729-en
General
-
Target
0eaf2f04892df638d00d54cbfe5e9970N.exe
-
Size
824KB
-
MD5
0eaf2f04892df638d00d54cbfe5e9970
-
SHA1
2b73bf5f86b91ef58ab42f9551a0197b89d1631a
-
SHA256
a3b9e1335ddf574bc56e51ca2ce8b316e8d6a774b912c0c86b4ec1349bbc3941
-
SHA512
9d9e56d095b06a272b6dc2c4abcfff34600595bd7144a044408c756717d234b096616bad87d3149073cba014ee3e885bf935b5b18656d4b83c4fa93801fa89f4
-
SSDEEP
12288:kV8I9SdTOyLCQwGbgNKuoWyae8sOTT/FeJgDXwZknTwTfyxKNJh:kAdJLCTc8sOTT/FenIsfya3
Malware Config
Extracted
trickbot
2000031
tot122
14.232.161.45:443
118.173.233.64:443
41.57.156.203:443
45.239.234.2:443
45.201.136.3:443
177.10.90.29:443
185.17.105.236:443
91.237.161.87:443
185.189.55.207:443
186.225.119.170:443
143.0.208.20:443
222.124.16.74:443
220.82.64.198:443
200.236.218.62:443
178.216.28.59:443
45.239.233.131:443
196.216.59.174:443
119.202.8.249:443
82.159.149.37:443
49.248.217.170:443
181.114.215.239:443
113.160.132.237:443
105.30.26.50:443
202.165.47.106:443
103.122.228.44:443
-
autorunName:pwgrabbName:pwgrabc
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1172 3636 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0eaf2f04892df638d00d54cbfe5e9970N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3996 wermgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3636 0eaf2f04892df638d00d54cbfe5e9970N.exe 3636 0eaf2f04892df638d00d54cbfe5e9970N.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3636 wrote to memory of 3996 3636 0eaf2f04892df638d00d54cbfe5e9970N.exe 84 PID 3636 wrote to memory of 3996 3636 0eaf2f04892df638d00d54cbfe5e9970N.exe 84 PID 3636 wrote to memory of 4816 3636 0eaf2f04892df638d00d54cbfe5e9970N.exe 88 PID 3636 wrote to memory of 4816 3636 0eaf2f04892df638d00d54cbfe5e9970N.exe 88 PID 3636 wrote to memory of 3996 3636 0eaf2f04892df638d00d54cbfe5e9970N.exe 84 PID 3636 wrote to memory of 3996 3636 0eaf2f04892df638d00d54cbfe5e9970N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0eaf2f04892df638d00d54cbfe5e9970N.exe"C:\Users\Admin\AppData\Local\Temp\0eaf2f04892df638d00d54cbfe5e9970N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵PID:4816
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3636 -s 5922⤵
- Program crash
PID:1172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3636 -ip 36361⤵PID:4664