Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 00:57

General

  • Target

    42e7b2aae70007120a0484488a4866a4bdade9fe0d0ffc2441e368412c927864N.exe

  • Size

    1.1MB

  • MD5

    534f7a3dad2f06175672ffb588f681d0

  • SHA1

    3c89480c93d80c2054c2119d7051215a8538133e

  • SHA256

    42e7b2aae70007120a0484488a4866a4bdade9fe0d0ffc2441e368412c927864

  • SHA512

    c0a9109ddd1c84b7832e84cdf7c97fd4365170a5249c84f0ae3ae1d55156aa63b0a3976a736f97d2d77c1072d02e283612891bc99c9001d56913ff8187d9d2a7

  • SSDEEP

    24576:14oBPH/brsSBuqTxnBwRIFma/ZSoa/JXRP8lI:1pH/brsSUq9BwRIFmg/gfP8lI

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Program crash 15 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42e7b2aae70007120a0484488a4866a4bdade9fe0d0ffc2441e368412c927864N.exe
    "C:\Users\Admin\AppData\Local\Temp\42e7b2aae70007120a0484488a4866a4bdade9fe0d0ffc2441e368412c927864N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 344
      2⤵
      • Program crash
      PID:1784
    • C:\Users\Admin\AppData\Local\Temp\42e7b2aae70007120a0484488a4866a4bdade9fe0d0ffc2441e368412c927864N.exe
      C:\Users\Admin\AppData\Local\Temp\42e7b2aae70007120a0484488a4866a4bdade9fe0d0ffc2441e368412c927864N.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:1404
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 344
        3⤵
        • Program crash
        PID:3500
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 628
        3⤵
        • Program crash
        PID:3372
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 656
        3⤵
        • Program crash
        PID:1040
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 628
        3⤵
        • Program crash
        PID:2232
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 736
        3⤵
        • Program crash
        PID:4804
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 884
        3⤵
        • Program crash
        PID:4692
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1416
        3⤵
        • Program crash
        PID:2448
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1508
        3⤵
        • Program crash
        PID:2740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1424
        3⤵
        • Program crash
        PID:1092
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1640
        3⤵
        • Program crash
        PID:3684
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1464
        3⤵
        • Program crash
        PID:2748
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1708
        3⤵
        • Program crash
        PID:4040
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1640
        3⤵
        • Program crash
        PID:3836
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 1428
        3⤵
        • Program crash
        PID:2548
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2652 -ip 2652
    1⤵
      PID:4436
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1404 -ip 1404
      1⤵
        PID:1044
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1404 -ip 1404
        1⤵
          PID:3128
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1404 -ip 1404
          1⤵
            PID:4152
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1404 -ip 1404
            1⤵
              PID:3536
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1404 -ip 1404
              1⤵
                PID:5100
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1404 -ip 1404
                1⤵
                  PID:1112
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1404 -ip 1404
                  1⤵
                    PID:3464
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1404 -ip 1404
                    1⤵
                      PID:2664
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1404 -ip 1404
                      1⤵
                        PID:2436
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1404 -ip 1404
                        1⤵
                          PID:2244
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1404 -ip 1404
                          1⤵
                            PID:3324
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1404 -ip 1404
                            1⤵
                              PID:1932
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1404 -ip 1404
                              1⤵
                                PID:3104
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1404 -ip 1404
                                1⤵
                                  PID:3604

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\42e7b2aae70007120a0484488a4866a4bdade9fe0d0ffc2441e368412c927864N.exe

                                  Filesize

                                  1.1MB

                                  MD5

                                  544e48e462175b7b061c9ac16f03fea8

                                  SHA1

                                  3c4a01d9c09a9d10817ddc9952f6a373262917ca

                                  SHA256

                                  3e3d56ad7ed8a0ce30c02f2498ed3a1a7a1975401c55cbb0caee35a9cf5199d2

                                  SHA512

                                  842e462126529486d68cb0073cbfb79512c23dbf250153cf246367aa21f08c4cb4078b476b1ded0975d6269075be0912b86642a7f0a52b69a028e4b749b9c184

                                • memory/1404-6-0x0000000000400000-0x0000000000518000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/1404-8-0x00000000050A0000-0x00000000051B8000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/1404-9-0x0000000000400000-0x00000000004A3000-memory.dmp

                                  Filesize

                                  652KB

                                • memory/1404-21-0x0000000000400000-0x0000000000443000-memory.dmp

                                  Filesize

                                  268KB

                                • memory/1404-27-0x000000000BA50000-0x000000000BAF3000-memory.dmp

                                  Filesize

                                  652KB

                                • memory/1404-28-0x0000000000400000-0x0000000000518000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2652-0-0x0000000000400000-0x0000000000518000-memory.dmp

                                  Filesize

                                  1.1MB

                                • memory/2652-7-0x0000000000400000-0x0000000000518000-memory.dmp

                                  Filesize

                                  1.1MB