Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe
Resource
win10v2004-20240802-en
General
-
Target
cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe
-
Size
129KB
-
MD5
a7814ab4e065b9cd3d4544d560a7fc90
-
SHA1
8101ad182ebb373196626389d0c3c6be9791dc3a
-
SHA256
cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141
-
SHA512
d1f1685d6cb6ac70646dd6d4ff24831984d45cd272864db7280ecc6da6c9883300c2379ff978e7832fc1b7b355618483c4d50097fa74ad732beaece0b8900382
-
SSDEEP
1536:bqgkhB9I4BcDQX2oooD+AyxArAIVJ9bayZbScKEang5V2pe6yq7tao2M:bW5I46QXMmAIX1tanUV2piDo2
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened (read-only) \??\B: cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe -
Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\dotnet\dotnet.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\7-Zip\7z.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\7-Zip\7zG.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3056 3612 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe"C:\Users\Admin\AppData\Local\Temp\cba8b1fb919e6ae7f21e7942f6d0adce4d38c3929314f1e55d57082e354b5141N.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 4602⤵
- Program crash
PID:3056
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3612 -ip 36121⤵PID:2868