Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/12/2024, 13:07

General

  • Target

    factura 000601.exe

  • Size

    949KB

  • MD5

    daa9839e2d085683d0a9f98bf1a485cf

  • SHA1

    62a0fd15177c5b8123a05be32fd1427e8cf2bbb3

  • SHA256

    e51d2899706d1fc7b2ceb507d49ffd09be932c79e99b0c820eaabe6b39b980c5

  • SHA512

    b2a5e944d367711f44d8c8b2035d30950475631b5e62ad9a4e46910fe50fb23a23f18fa1ab6eee11959b9e801b7ab40a8ae148ac015f01ed0c1a1dfd029b858d

  • SSDEEP

    24576:uRmJkcoQricOIQxiZY1iaCvqoG0Q+98vd5PG:7JZoQrbTFZY1iaCvs05KjPG

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\factura 000601.exe
    "C:\Users\Admin\AppData\Local\Temp\factura 000601.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\factura 000601.exe"
      2⤵
        PID:3040
      • C:\Users\Admin\AppData\Local\Temp\factura 000601.exe
        "C:\Users\Admin\AppData\Local\Temp\factura 000601.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1560
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\factura 000601.exe"
          3⤵
            PID:4808
          • C:\Users\Admin\AppData\Local\Temp\factura 000601.exe
            "C:\Users\Admin\AppData\Local\Temp\factura 000601.exe"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:640
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Users\Admin\AppData\Local\Temp\factura 000601.exe"
              4⤵
                PID:4940
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 740
                4⤵
                • Program crash
                PID:3972
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 640 -ip 640
          1⤵
            PID:2240

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\autCE6C.tmp

            Filesize

            263KB

            MD5

            57edaa8382ff8c9d62264ca23d5cd026

            SHA1

            be4cf11fe9f311b817c1410cc1630b3ef6ef3632

            SHA256

            954f3c73beb262a1481b8be0ff0d847086d60652a2380dcd7bc13280c8c37a62

            SHA512

            6086d99a0da4fe2f17139d1767ebc119c671afeb4f22706294744e5e6eaf2b7f9ef910b7a970e1b9ab12ade5bb22875cd0c290456540e603b16865839a2df287

          • memory/2060-7-0x0000000003290000-0x0000000003294000-memory.dmp

            Filesize

            16KB