Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26/06/2022, 05:20
Static task
static1
Behavioral task
behavioral1
Sample
asdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
asdf.exe
Resource
win10v2004-20220414-en
General
-
Target
asdf.exe
-
Size
772KB
-
MD5
d946c183fd128b4acf88d83ee89d79d3
-
SHA1
6f35da72f339c7101e93a7adada27d24902db598
-
SHA256
529586cbbd8586d7f33a3ea9bdd517b7ead617b4e12165106e81e4bfad859474
-
SHA512
793727b08b92df108144308a7ac798e55ba35742308db18466cce6caa564b6c1cb5b0fece2850511450f69e497df1dba49a9cb3a0ff17b4f9cc27e05ef2fcd62
Malware Config
Extracted
arkei
Default
Extracted
recordbreaker
http://136.244.65.99/
http://140.82.52.55/
Signatures
-
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
Executes dropped EXE 2 IoCs
pid Process 2224 fcvtee.exe 3556 fcvtee.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation asdf.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2224 set thread context of 3556 2224 fcvtee.exe 82 PID 3116 set thread context of 2112 3116 asdf.exe 81 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2224 fcvtee.exe 3116 asdf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3116 asdf.exe 2224 fcvtee.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3116 wrote to memory of 2224 3116 asdf.exe 80 PID 3116 wrote to memory of 2224 3116 asdf.exe 80 PID 3116 wrote to memory of 2224 3116 asdf.exe 80 PID 2224 wrote to memory of 3556 2224 fcvtee.exe 82 PID 2224 wrote to memory of 3556 2224 fcvtee.exe 82 PID 2224 wrote to memory of 3556 2224 fcvtee.exe 82 PID 3116 wrote to memory of 2112 3116 asdf.exe 81 PID 3116 wrote to memory of 2112 3116 asdf.exe 81 PID 3116 wrote to memory of 2112 3116 asdf.exe 81 PID 2224 wrote to memory of 3556 2224 fcvtee.exe 82 PID 3116 wrote to memory of 2112 3116 asdf.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\asdf.exe"C:\Users\Admin\AppData\Local\Temp\asdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Roaming\fcvtee.exe"C:\Users\Admin\AppData\Roaming\fcvtee.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Roaming\fcvtee.exe"C:\Users\Admin\AppData\Roaming\fcvtee.exe"3⤵
- Executes dropped EXE
PID:3556
-
-
-
C:\Users\Admin\AppData\Local\Temp\asdf.exe"C:\Users\Admin\AppData\Local\Temp\asdf.exe"2⤵PID:2112
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392KB
MD532ab5685131d8bcfa172bf165adf9338
SHA15e3b167bc66a15c246a8f29f7b634cbe52731319
SHA2562a0dc11c02495205fadbbb4a5a5304a9e77fd079dcab58daa04804a59e4cc87e
SHA512c6a48a49427a260510f08e8fd93a626445e69659c6e60364308163c92866ed43f163fee3e3f44951466457331eb0804d6e97ba623cfab20b7ef52e74c5c3e437
-
Filesize
392KB
MD532ab5685131d8bcfa172bf165adf9338
SHA15e3b167bc66a15c246a8f29f7b634cbe52731319
SHA2562a0dc11c02495205fadbbb4a5a5304a9e77fd079dcab58daa04804a59e4cc87e
SHA512c6a48a49427a260510f08e8fd93a626445e69659c6e60364308163c92866ed43f163fee3e3f44951466457331eb0804d6e97ba623cfab20b7ef52e74c5c3e437
-
Filesize
392KB
MD532ab5685131d8bcfa172bf165adf9338
SHA15e3b167bc66a15c246a8f29f7b634cbe52731319
SHA2562a0dc11c02495205fadbbb4a5a5304a9e77fd079dcab58daa04804a59e4cc87e
SHA512c6a48a49427a260510f08e8fd93a626445e69659c6e60364308163c92866ed43f163fee3e3f44951466457331eb0804d6e97ba623cfab20b7ef52e74c5c3e437