Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
05/02/2025, 10:34
250205-mmg7watqer 305/02/2025, 10:33
250205-mljdjssnet 322/06/2024, 18:41
240622-xb3pjsyhpe 1022/06/2024, 17:04
240622-vlcj1azdrp 10Analysis
-
max time kernel
194s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
05/02/2025, 10:34
Static task
static1
Behavioral task
behavioral1
Sample
df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
General
-
Target
df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe
-
Size
534KB
-
MD5
8e8eaa9b81f664c796225ac49e9ecb71
-
SHA1
320e25a4b4918dd76582c7f7e68f3d68268b17f7
-
SHA256
df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d
-
SHA512
66529bd7faa3275856fa87e7ec5ed250b0fc694f12e5fab2d1e84aa367844d42c7a19911065c9f2985752d55addc921797c77861081f2f40b5f1a69f84d935d0
-
SSDEEP
12288:1FF+1IiVMR/La01MZa03EiYIRKoMDKd+A1Ll7e7:1FFroMROFZa03EiYILWWvll74
Malware Config
Signatures
-
Program crash 2 IoCs
pid pid_target Process procid_target 3320 3400 WerFault.exe 82 772 3400 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3236 WINWORD.EXE 3236 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 3400 df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe 3400 df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 316 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 316 taskmgr.exe Token: SeSystemProfilePrivilege 316 taskmgr.exe Token: SeCreateGlobalPrivilege 316 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe 316 taskmgr.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3236 WINWORD.EXE 3236 WINWORD.EXE 3236 WINWORD.EXE 3236 WINWORD.EXE 3236 WINWORD.EXE 3236 WINWORD.EXE 3236 WINWORD.EXE 3236 WINWORD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe"C:\Users\Admin\AppData\Local\Temp\df2175421c791abbbe00721d185b0126fdcfa65948c5df89db284ccd4ae65d4d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 5442⤵
- Program crash
PID:3320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 5522⤵
- Program crash
PID:772
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3400 -ip 34001⤵PID:2156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3400 -ip 34001⤵PID:1536
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\RenameImport.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
270B
MD5e30e6ef86a47d64b5d890b46533fcd72
SHA1819269f3df81bc20a233d66c9a923ba9bffa70be
SHA256a6122255f19a453049ebce945d5b841a4d3b44d9c6461a012435663b8f8807cf
SHA5121026945f06e63470f382c086708650f264ca1d21b7e8b0b5afab8a126a7c53363b8bed651887bb4c27114015df60716b337da9c1e8173363c9823f5ad0f12f63
-
Filesize
12B
MD5f6f801e5b0502f5e803ed826dd37ae44
SHA1273e87aa518397186653443c0c3e81d574361708
SHA256e7bcd23ba708556ee69f96050dc7e74f9dab95825bfab48bcea7fd8fac482fd1
SHA5128fe0217b9c7f9331664dc4259c7924b9c7e5e145f0b795ec98d713e41a2e3d001014b3ac41071fe41447632ddbfbbefc8c7d6de8fa9faeca455a0a78575e5584
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD51cf6c088c953e4da68f4635d9da2b134
SHA1475d17f32875416d698c9c86745ecc2d73303e18
SHA256ed5756e02736321174ce32582b30a4c592691a71762bee61c3f7736fb62c7a3f
SHA512d2cd2d4f2ce40ce094188d215360286b680a204ab3ee39746d7c6d41ae71d21c874c9015059f677de51a987a3c77654be1edb4e1476a8ef44967d3087ac94b0c