Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
Documenti di spedizione 0002838844.exe
Resource
win7-20240708-en
General
-
Target
Documenti di spedizione 0002838844.exe
-
Size
695KB
-
MD5
2505793cd3edee5e7ceab9359a8a74ba
-
SHA1
30437e6082392072f27fd3609e6aac5d161c45a8
-
SHA256
8cce7f3f93f7d317da18beb13332f1ad601c4552022d07d7e28d1d836eedba81
-
SHA512
58f4dd9082ed1b7721030f1f7ac74bdb7878153081839d13ebf0027ea9d47cfb198d9cad97645b915a981442716979b7ef48e751e13f69f0a7bcf7e0aab2a2ba
-
SSDEEP
6144:JpkXchsEnW7+8WIEZb8Qj+iHK5sDlK+f+gsw8XuMEbHdLP7LoMg//YgNfegoWK2E:YvWIKbnKiHEsM60Z/Y8emeFFwP0nRUq
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3052 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4056 3052 WerFault.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Documenti di spedizione 0002838844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3052 powershell.exe 3052 powershell.exe 3052 powershell.exe 3052 powershell.exe 3052 powershell.exe 3052 powershell.exe 3052 powershell.exe 3052 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3052 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4500 wrote to memory of 3052 4500 Documenti di spedizione 0002838844.exe 92 PID 4500 wrote to memory of 3052 4500 Documenti di spedizione 0002838844.exe 92 PID 4500 wrote to memory of 3052 4500 Documenti di spedizione 0002838844.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Documenti di spedizione 0002838844.exe"C:\Users\Admin\AppData\Local\Temp\Documenti di spedizione 0002838844.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$sharping=Get-Content 'C:\Users\Admin\AppData\Local\Konfektionernes\Segment.Sam';$qatars=$sharping.SubString(43606,3);.$qatars($sharping)2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 26963⤵
- Program crash
PID:4056
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4468,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:81⤵PID:772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3052 -ip 30521⤵PID:1736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5bc4900725d3d13feb8409643ec5b42a8
SHA113e40afed666594caf9bfee6f07f4bc9039c04e7
SHA2566741b125848e3a2ec6665e467bf819de8d9dd0a7cddd5642bcc64f6acadd8dc8
SHA512732b2751117b41979c216685aa4211453e180c641fa85cac2a76ce56e802734a3257dddd3731c5801c0c1063ed933f9e89be7a956b586051cde5d3ff940518d1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82