Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2025, 03:45
Behavioral task
behavioral1
Sample
f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe
Resource
win7-20240903-en
General
-
Target
f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe
-
Size
626KB
-
MD5
e4da22458c317595e4bd6712b4728d36
-
SHA1
111a5c4cbd45bced7c04cbeb5192a9afe178865c
-
SHA256
f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd
-
SHA512
b19d9eb5e06834538e8ca5e8655e360b56d63c8ad67441607279c18a848d46a6095b6cbe7019fc79eba784392278e30134e7aef149d0e12964d0b86ecd08dc1d
-
SSDEEP
12288:ROv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPifIl4AbNfoQ+MvFE7v44OzNRlwDmt:Rq5TfcdHj4fmbMo3Jhuv44O5fwY
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\juvenile.vbs juvenile.exe -
Executes dropped EXE 1 IoCs
pid Process 3500 juvenile.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4884-14-0x0000000000660000-0x00000000007CA000-memory.dmp autoit_exe behavioral2/memory/3500-22-0x00000000013F0000-0x00000000017F0000-memory.dmp autoit_exe behavioral2/memory/3500-25-0x0000000000400000-0x000000000056A000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/4884-0-0x0000000000660000-0x00000000007CA000-memory.dmp upx behavioral2/files/0x0008000000023c71-10.dat upx behavioral2/memory/3500-12-0x0000000000400000-0x000000000056A000-memory.dmp upx behavioral2/memory/4884-14-0x0000000000660000-0x00000000007CA000-memory.dmp upx behavioral2/memory/3500-25-0x0000000000400000-0x000000000056A000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2932 3500 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language juvenile.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4884 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 4884 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 3500 juvenile.exe 3500 juvenile.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4884 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 4884 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 3500 juvenile.exe 3500 juvenile.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4884 wrote to memory of 3500 4884 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 83 PID 4884 wrote to memory of 3500 4884 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 83 PID 4884 wrote to memory of 3500 4884 f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe 83 PID 3500 wrote to memory of 4732 3500 juvenile.exe 84 PID 3500 wrote to memory of 4732 3500 juvenile.exe 84 PID 3500 wrote to memory of 4732 3500 juvenile.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe"C:\Users\Admin\AppData\Local\Temp\f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\thixolabile\juvenile.exe"C:\Users\Admin\AppData\Local\Temp\f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd.exe"3⤵PID:4732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 7243⤵
- Program crash
PID:2932
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3500 -ip 35001⤵PID:1124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
626KB
MD5e4da22458c317595e4bd6712b4728d36
SHA1111a5c4cbd45bced7c04cbeb5192a9afe178865c
SHA256f3530f9d52d1ba3ed70cc5d603cf0a83771027cda5fd545206e1688589ef69fd
SHA512b19d9eb5e06834538e8ca5e8655e360b56d63c8ad67441607279c18a848d46a6095b6cbe7019fc79eba784392278e30134e7aef149d0e12964d0b86ecd08dc1d