Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
17/02/2025, 01:52
Static task
static1
Behavioral task
behavioral1
Sample
ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe
Resource
win10v2004-20250207-en
General
-
Target
ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe
-
Size
995KB
-
MD5
c9cbedbddefc0242501c86d2481f7396
-
SHA1
f2037325c8213bba65d2ca2e32fa1020e0bf12ee
-
SHA256
ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616
-
SHA512
6b509ab586bf14e0ff34ce1ba0846c8256770089897a48660594dffaf99673ada2b7a92f9784aaa4cae2932c63da6be36091f10dac78dc9fd5990775e5924b33
-
SSDEEP
12288:4jauDReW+A2xwaLhRe2OA6SwXmBXysCcVGRhcnw+UT+RiJ7OSnShaAd:4DDaAWZTcAldCqwxlOQeld
Malware Config
Signatures
-
Downloads MZ/PE file 1 IoCs
flow pid Process 57 2028 Process not Found -
Executes dropped EXE 1 IoCs
pid Process 5028 wvuheu.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\wvuheu.exe" wvuheu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wvuheu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3928 MicrosoftEdgeUpdate.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4264 wrote to memory of 5028 4264 ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe 87 PID 4264 wrote to memory of 5028 4264 ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe 87 PID 4264 wrote to memory of 5028 4264 ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe"C:\Users\Admin\AppData\Local\Temp\ee908628c2589347e6e05c66b5fdc200ba996efabbd1401f1c3c761fe2e2a616.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\ProgramData\wvuheu.exe"C:\ProgramData\wvuheu.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5028
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RTI0NThCQkQtNTRCNi00MjA1LTg2OEYtQzhCQzc4OTM3NzRGfSIgdXNlcmlkPSJ7REVEQjFEQTYtMzcxRi00MkY2LTk2Q0QtMTg3NkEyODBDRDY1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjQyRUQ5RkEtQUI0Ny00MjAxLUE2RUQtOUQzRTY5NkI0RUM0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI5IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTA0MjA3NzA0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3928
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
995KB
MD5e9cd29b3bcf6677f30590c90e05a9296
SHA18b23b33296faaafd45984271782bd6318964f4a8
SHA256f367b6de457240311de655bc5cc4de6e1a478a2c119b25e22adc8b05a89ed714
SHA5123e1e012bac9cf54db63e922711562c1187def0b68cfba8220b73194c2249bab8b4da5c211c5c0f14bdc4d9e2551e047424c7e70ddde93f87062a62642aaa8575
-
Filesize
136KB
MD5cb4c442a26bb46671c638c794bf535af
SHA18a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf
SHA256f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25
SHA512074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3
-
Filesize
859KB
MD5ff90da3c96f2cb9025a8ebd64d35db0f
SHA16ce7ccaccede229b20014712ca1e3c6f9d8f8cff
SHA2564839ba013898ee9dbc9bafa8d803917966c28bf4b9b83f828b33f7f75a94cb98
SHA512db6454d5b0d856226f4c37927b6c71a6156d871f2e92343861fb5cc0ce32ffe7e5cd39684bba71f5f256503aefa79665be5c728fc5f0bd12da758b82e1be9db5