Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 10:49
Static task
static1
Behavioral task
behavioral1
Sample
596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe
Resource
win10v2004-20240802-en
General
-
Target
596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe
-
Size
457KB
-
MD5
fd298c7e47aa48480c46aa46b9960de0
-
SHA1
8d6d60879d2b7825cac6734e07417f2258412f21
-
SHA256
596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180
-
SHA512
e9048b79bbf8a8999c0cbfb469be17b44bdbf49c65a6699c8624fcfc2bba55fcb0053817a225bd51b4fe2d348b1bbc676445eedca08d6294c3afb191270dfb11
-
SSDEEP
12288:dfHdyKR7PfIcCKdjo47UQejmOFJ7hY2Sfe/:dfHQALIbKWEReXFJ7hY2
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3624 hG01814NnKiC01814.exe -
Executes dropped EXE 1 IoCs
pid Process 3624 hG01814NnKiC01814.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hG01814NnKiC01814 = "C:\\ProgramData\\hG01814NnKiC01814\\hG01814NnKiC01814.exe" hG01814NnKiC01814.exe -
resource yara_rule behavioral2/memory/3152-2-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/3152-14-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/3152-15-0x0000000000400000-0x00000000004BF000-memory.dmp upx behavioral2/memory/3624-18-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/3624-26-0x0000000000400000-0x00000000004C1000-memory.dmp upx behavioral2/memory/3624-31-0x0000000000400000-0x00000000004C1000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2420 3624 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hG01814NnKiC01814.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3152 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 3152 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe 3624 hG01814NnKiC01814.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3152 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe Token: SeDebugPrivilege 3624 hG01814NnKiC01814.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3152 wrote to memory of 3624 3152 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 82 PID 3152 wrote to memory of 3624 3152 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 82 PID 3152 wrote to memory of 3624 3152 596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe"C:\Users\Admin\AppData\Local\Temp\596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\ProgramData\hG01814NnKiC01814\hG01814NnKiC01814.exe"C:\ProgramData\hG01814NnKiC01814\hG01814NnKiC01814.exe" "C:\Users\Admin\AppData\Local\Temp\596fe949491f87114bd1c055bcb5a439691031da0328ec871d5fe25fd2e00180N.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3624 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 13323⤵
- Program crash
PID:2420
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3624 -ip 36241⤵PID:1464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
457KB
MD52721d5c8fc0a913ccf1188b266c599cb
SHA1aeb3f98e2fb232e06e182170160eeb1aa57842fd
SHA25695b6d1160d5ae69d789d951838c72488a98876d958db8e28bf87910b95a003a8
SHA51231e3c7cf3ca48bf6a8ccb449acb83077f2ff303df59b672029c988675d43060734f039b67aef02cb2ca3062a6706dc72c16576ef5e3d2b559018386c6e1cf1f5