Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    103s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 20:58

General

  • Target

    410ad42c401d2c43db5977b49ca27b24f6172ce478a6d4a20d7edc9e60f25000.exe

  • Size

    3.0MB

  • MD5

    f11fd043f1263a6f3d92b8d5b3a40959

  • SHA1

    a1fc5a7aace39cb0c1de8b01779255960486f31f

  • SHA256

    410ad42c401d2c43db5977b49ca27b24f6172ce478a6d4a20d7edc9e60f25000

  • SHA512

    a5a43652120c1142db823598c9302eb646265b1b2fed5bed9d92a3485c861ff6b5f7de56a1df631fd6b9d4c6f5b7111e35a51db2e28c6ed7e37c57a601166954

  • SSDEEP

    49152:GtSL8K3mO+3LZT06JKFoCfwxpdFx7OFCrPYVGwv5Mv2xplBVeH:MSYym3LZ5/KGdFxBKw2xr4

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\410ad42c401d2c43db5977b49ca27b24f6172ce478a6d4a20d7edc9e60f25000.exe
    "C:\Users\Admin\AppData\Local\Temp\410ad42c401d2c43db5977b49ca27b24f6172ce478a6d4a20d7edc9e60f25000.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2800
    • \??\c:\users\admin\appdata\local\temp\wmpscfgs.exe
      c:\users\admin\appdata\local\temp\\wmpscfgs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:396
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 452
        3⤵
        • Program crash
        PID:2888
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 452
        3⤵
        • Program crash
        PID:3552
    • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
      C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 452
        3⤵
        • Program crash
        PID:1120
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 452
        3⤵
        • Program crash
        PID:1436
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 664 -ip 664
    1⤵
      PID:2000
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 396 -ip 396
      1⤵
        PID:4444
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 664 -ip 664
        1⤵
          PID:4576
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 396 -ip 396
          1⤵
            PID:1824

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

            Filesize

            3.0MB

            MD5

            1d0ee0a73c29d76a38596a0b8995e6a5

            SHA1

            f2576e2000c0b9bab9433fa64a686f5a9688b1a8

            SHA256

            ceb883dcc2c9d7ee05c485d62b91b90c52383152c6dc458e5589e7e1b19529b1

            SHA512

            f7e1b23d78ed1ae471507f07065b96b53700d35559d1c3f3b096edd5381df682d60061f49e82af3752559812e26a666ff5e77c3f05df110a285a9c16a45a1d1c

          • C:\Users\Admin\AppData\Local\Temp\wmpscfgs.exe

            Filesize

            3.0MB

            MD5

            d91805802610e516bc544cd386596be0

            SHA1

            06c1de714f1f2249ea4cbf223921f115f9e340b2

            SHA256

            581d6bb136931dee0f4b582611c22175a23514b83f56db11c3e8723a632c5c84

            SHA512

            f7a8081b447a304c1dd66bcad63e974fb5c90e2cb832ee69ca3bb185ad7d16e5586096c6f2e03add5cd32731b81e832e5c23567385f8e20c0ceefd605ffe4784

          • memory/396-19-0x000000007FA70000-0x000000007FE41000-memory.dmp

            Filesize

            3.8MB

          • memory/396-22-0x0000000000400000-0x0000000000DB6000-memory.dmp

            Filesize

            9.7MB

          • memory/664-18-0x0000000000400000-0x0000000000DB6000-memory.dmp

            Filesize

            9.7MB

          • memory/664-20-0x000000007FA70000-0x000000007FE41000-memory.dmp

            Filesize

            3.8MB

          • memory/664-21-0x0000000000400000-0x0000000000DB6000-memory.dmp

            Filesize

            9.7MB

          • memory/2800-0-0x0000000000400000-0x0000000000DB6000-memory.dmp

            Filesize

            9.7MB

          • memory/2800-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

            Filesize

            3.8MB

          • memory/2800-3-0x0000000010000000-0x0000000010010000-memory.dmp

            Filesize

            64KB

          • memory/2800-17-0x000000007FA70000-0x000000007FE41000-memory.dmp

            Filesize

            3.8MB

          • memory/2800-16-0x0000000000400000-0x0000000000DB6000-memory.dmp

            Filesize

            9.7MB