Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2024, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
araew.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
araew.exe
Resource
win10v2004-20241007-en
General
-
Target
3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe
-
Size
213KB
-
MD5
19711c7b13e7717d3e225bb8cf87a6eb
-
SHA1
eefec05b24b941ae4b0d24c3ae2f1c394aeee63c
-
SHA256
3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe
-
SHA512
0486b2a6ccef06fd49961c3b105d2587e85df9cabc061fb23b4b8fabad6810245571f9948c824d960807f1d590abee8ac8c86d3404e2c2893d9b4ef6388d1040
-
SSDEEP
3072:WfJSq+ytGIon9KcSMiTPLqS5G7cLX+B61j/Ly3AtdwEDdlmcXbCdnXUCNlAYgVOM:MEa0NiT1DqKCWd7hMcX8kvUAwWiK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4172 araew.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bskdop = "C:\\Users\\Admin\\AppData\\Roaming\\qseiuf\\trhllwhnovvfg.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\araew.exe\"" araew.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4200 4172 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language araew.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1940 wrote to memory of 4172 1940 3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe 85 PID 1940 wrote to memory of 4172 1940 3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe 85 PID 1940 wrote to memory of 4172 1940 3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe 85 PID 4172 wrote to memory of 3600 4172 araew.exe 86 PID 4172 wrote to memory of 3600 4172 araew.exe 86 PID 4172 wrote to memory of 3600 4172 araew.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe"C:\Users\Admin\AppData\Local\Temp\3c783827c751d8155644f546b2d6b5306a2520fff907a962a669f3f86cf5c9fe.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\araew.exe"C:\Users\Admin\AppData\Local\Temp\araew.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\araew.exe"C:\Users\Admin\AppData\Local\Temp\araew.exe"3⤵PID:3600
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 5923⤵
- Program crash
PID:4200
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4172 -ip 41721⤵PID:3308
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD577bd81274a2c432284179bea00ea29c6
SHA192d5d6b2bcc4b5e9903105d3593c1eb83f8c0edd
SHA256ea51a0a70ba6dd2f1b40c97fe8df313b9b7b0f49f172e3e925416c88049620af
SHA512a26d004bbe48d9c8cf6bdb95ef801a07ff431c8bbdbfcbc0b7b4458e4ba42c82be1945291cc180d2ef4fbe54cc07dbe7678fdf43be61fa2e09cfecf327decf54
-
Filesize
134KB
MD563ec82480dc2e920bf8501af8f15c0e2
SHA10c9811a0d78963fccf0ac0296fcc1abcf8cc56ad
SHA2566c0b8384374c461bc6601cc3eca2d2fa5e50c34531a27f7219384fab2a69bf01
SHA512fd25a005f179de245df74b2be282283ac3e59e7fe8a4d330ea8930a982ca4366663eaaf25c155617e96d64f9ba82c83250f2233756e197b7f04c6b154633b7df
-
Filesize
7KB
MD562cd8461b79cb1ad9c1b5b2965f3cf87
SHA1291b8893012f284662a2c907eee495354faee8bb
SHA2564931e459e3d6d89790f718dafbc92c63bbef6cc67911fffd4aa8aa7c2dcdb24d
SHA5121b3da3bd9a16d2cb3798fc9aa463b9b5c62c00485e4539f98c286cf6f4ae0902abcdc782e4818036d233127bfd39c89e2b44e0e6b3fe4ecc3d66386385c22728