Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2024, 15:50

General

  • Target

    3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe

  • Size

    213KB

  • MD5

    19711c7b13e7717d3e225bb8cf87a6eb

  • SHA1

    eefec05b24b941ae4b0d24c3ae2f1c394aeee63c

  • SHA256

    3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe

  • SHA512

    0486b2a6ccef06fd49961c3b105d2587e85df9cabc061fb23b4b8fabad6810245571f9948c824d960807f1d590abee8ac8c86d3404e2c2893d9b4ef6388d1040

  • SSDEEP

    3072:WfJSq+ytGIon9KcSMiTPLqS5G7cLX+B61j/Ly3AtdwEDdlmcXbCdnXUCNlAYgVOM:MEa0NiT1DqKCWd7hMcX8kvUAwWiK

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe
    "C:\Users\Admin\AppData\Local\Temp\3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Users\Admin\AppData\Local\Temp\araew.exe
      "C:\Users\Admin\AppData\Local\Temp\araew.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4172
      • C:\Users\Admin\AppData\Local\Temp\araew.exe
        "C:\Users\Admin\AppData\Local\Temp\araew.exe"
        3⤵
          PID:3600
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 592
          3⤵
          • Program crash
          PID:4200
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4172 -ip 4172
      1⤵
        PID:3308

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\araew.exe

        Filesize

        69KB

        MD5

        77bd81274a2c432284179bea00ea29c6

        SHA1

        92d5d6b2bcc4b5e9903105d3593c1eb83f8c0edd

        SHA256

        ea51a0a70ba6dd2f1b40c97fe8df313b9b7b0f49f172e3e925416c88049620af

        SHA512

        a26d004bbe48d9c8cf6bdb95ef801a07ff431c8bbdbfcbc0b7b4458e4ba42c82be1945291cc180d2ef4fbe54cc07dbe7678fdf43be61fa2e09cfecf327decf54

      • C:\Users\Admin\AppData\Local\Temp\etnvupj.xe

        Filesize

        134KB

        MD5

        63ec82480dc2e920bf8501af8f15c0e2

        SHA1

        0c9811a0d78963fccf0ac0296fcc1abcf8cc56ad

        SHA256

        6c0b8384374c461bc6601cc3eca2d2fa5e50c34531a27f7219384fab2a69bf01

        SHA512

        fd25a005f179de245df74b2be282283ac3e59e7fe8a4d330ea8930a982ca4366663eaaf25c155617e96d64f9ba82c83250f2233756e197b7f04c6b154633b7df

      • C:\Users\Admin\AppData\Local\Temp\pjlje.e

        Filesize

        7KB

        MD5

        62cd8461b79cb1ad9c1b5b2965f3cf87

        SHA1

        291b8893012f284662a2c907eee495354faee8bb

        SHA256

        4931e459e3d6d89790f718dafbc92c63bbef6cc67911fffd4aa8aa7c2dcdb24d

        SHA512

        1b3da3bd9a16d2cb3798fc9aa463b9b5c62c00485e4539f98c286cf6f4ae0902abcdc782e4818036d233127bfd39c89e2b44e0e6b3fe4ecc3d66386385c22728

      • memory/4172-7-0x0000000000540000-0x0000000000542000-memory.dmp

        Filesize

        8KB