Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
106s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2024, 20:17
Static task
static1
Behavioral task
behavioral1
Sample
223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe
Resource
win10v2004-20241007-en
General
-
Target
223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe
-
Size
225KB
-
MD5
15bdafcca64ce276b461f76259145cb0
-
SHA1
5ff04425191cae6b861401682cbdd4cb0d5ba1d7
-
SHA256
223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342
-
SHA512
1c81c9818252bf31ffdcaa51397ac0a4e6fdc6e2ce612e9aa1eb37e09790a53ffd4dbd20baee8fb903ccb05ad136276caf93d48df90fac6518be3ffac5cccd18
-
SSDEEP
6144:LA2P27yTAnKGw0hjFhSR/W11yAJ9v0pMtRCpYM:LATuTAnKGwUAW3ycQqgf
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4364 1272 WerFault.exe 104 1456 3024 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winver.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 3528 Explorer.EXE Token: SeCreatePagefilePrivilege 3528 Explorer.EXE Token: SeShutdownPrivilege 3528 Explorer.EXE Token: SeCreatePagefilePrivilege 3528 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1272 winver.exe 3024 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3024 wrote to memory of 1272 3024 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe 104 PID 3024 wrote to memory of 1272 3024 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe 104 PID 3024 wrote to memory of 1272 3024 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe 104 PID 3024 wrote to memory of 1272 3024 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe 104 PID 1272 wrote to memory of 3528 1272 winver.exe 56 PID 3024 wrote to memory of 3528 3024 223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe"C:\Users\Admin\AppData\Local\Temp\223e49465f19d7bf8da9d8371fdfcf5fb61496702d6ac2228e6065c9ea6e9342N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 3004⤵
- Program crash
PID:4364
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 7683⤵
- Program crash
PID:1456
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:1800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1272 -ip 12721⤵PID:4716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3024 -ip 30241⤵PID:4708