Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5b0fc9842a...db.exe

windows7-x64

10

5b0fc9842a...db.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 00:31 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe

  • Size

    251KB

  • MD5

    4f7ab5d4c49c066debaefb768f1db000

  • SHA1

    d019b88f0a547914d4bc2e62451184807fb7d887

  • SHA256

    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb

  • SHA512

    0fcf110ccff218ff3d5cf712fda489e73a9fd103652350cda4c974f15c423fc20b21110b81ff94de45b6ac5a5837eea50c06ca54e44c662500c1c5a8e6f38c96

  • SSDEEP

    3072:K4L9uT6U+45GZD1e8jdBv9+5An1HCfdHLU9d6c6V1YBLSkPPPmynIGoqqWOXK:LL9uT6B4lw+5An1HCfdguqHnIi

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    "C:\Users\Admin\AppData\Local\Temp\5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Users\Admin\xfcuik.exe
      "C:\Users\Admin\xfcuik.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Maps connected drives based on registry
      • Drops autorun.inf file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:5084

Network

  • flag-us
    DNS
    ns1.anytime1.com
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime1.com
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime1.net
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime1.net
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime1.org
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime1.org
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime2.com
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime2.com
    IN A
    Response
    ns1.anytime2.com
    IN CNAME
    ziyuan.baidu.com
    ziyuan.baidu.com
    IN CNAME
    ziyuan.n.shifen.com
    ziyuan.n.shifen.com
    IN A
    182.61.201.50
    ziyuan.n.shifen.com
    IN A
    182.61.201.90
    ziyuan.n.shifen.com
    IN A
    182.61.201.91
    ziyuan.n.shifen.com
    IN A
    182.61.201.92
  • flag-us
    DNS
    ns1.anytime2.net
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime2.net
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime2.org
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime2.org
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime3.net
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime3.net
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime4.com
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime4.com
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime3.org
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime3.org
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime3.org
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime3.org
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime1.com
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime1.com
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime1.net
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime1.net
    IN A
    Response
  • flag-us
    DNS
    ns1.anytime1.org
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    Remote address:
    8.8.8.8:53
    Request
    ns1.anytime1.org
    IN A
    Response
  • 93.184.220.29:80
    260 B
     5
  • 20.190.160.20:443
    260 B
     5
  • 20.190.160.20:443
    260 B
     5
  • 93.184.220.29:80
    260 B
     5
  • 20.189.173.12:443
    322 B
     7
  • 8.238.21.254:80
    322 B
     7
  • 8.238.21.254:80
    322 B
     7
  • 8.238.21.254:80
    322 B
     7
  • 182.61.201.50:7001
    ns1.anytime2.com
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    260 B
     5
  • 8.8.8.8:53
    ns1.anytime1.com
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     135 B
     1
    1

    DNS Request

    ns1.anytime1.com

  • 8.8.8.8:53
    ns1.anytime1.net
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     135 B
     1
    1

    DNS Request

    ns1.anytime1.net

  • 8.8.8.8:53
    ns1.anytime1.org
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     144 B
     1
    1

    DNS Request

    ns1.anytime1.org

  • 8.8.8.8:53
    ns1.anytime2.com
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     183 B
     1
    1

    DNS Request

    ns1.anytime2.com

    DNS Response

    182.61.201.50
    182.61.201.90
    182.61.201.91
    182.61.201.92

  • 8.8.8.8:53
    ns1.anytime2.net
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     135 B
     1
    1

    DNS Request

    ns1.anytime2.net

  • 8.8.8.8:53
    ns1.anytime2.org
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     144 B
     1
    1

    DNS Request

    ns1.anytime2.org

  • 8.8.8.8:53
    ns1.anytime3.net
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     135 B
     1
    1

    DNS Request

    ns1.anytime3.net

  • 8.8.8.8:53
    ns1.anytime4.com
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     135 B
     1
    1

    DNS Request

    ns1.anytime4.com

  • 8.8.8.8:53
    ns1.anytime3.org
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    124 B
     288 B
     2
    2

    DNS Request

    ns1.anytime3.org

    DNS Request

    ns1.anytime3.org

  • 8.8.8.8:53
    ns1.anytime1.com
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     135 B
     1
    1

    DNS Request

    ns1.anytime1.com

  • 8.8.8.8:53
    ns1.anytime1.net
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     135 B
     1
    1

    DNS Request

    ns1.anytime1.net

  • 8.8.8.8:53
    ns1.anytime1.org
    dns
    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb.exe
    62 B
     144 B
     1
    1

    DNS Request

    ns1.anytime1.org

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\xfcuik.exe
    Filesize

    251KB

    MD5

    4f7ab5d4c49c066debaefb768f1db000

    SHA1

    d019b88f0a547914d4bc2e62451184807fb7d887

    SHA256

    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb

    SHA512

    0fcf110ccff218ff3d5cf712fda489e73a9fd103652350cda4c974f15c423fc20b21110b81ff94de45b6ac5a5837eea50c06ca54e44c662500c1c5a8e6f38c96

    Download Submit

  • C:\Users\Admin\xfcuik.exe
    Filesize

    251KB

    MD5

    4f7ab5d4c49c066debaefb768f1db000

    SHA1

    d019b88f0a547914d4bc2e62451184807fb7d887

    SHA256

    5b0fc9842a36bac898fede9c6c5990fd5f0ce2f635c11184af81fb508e1c8cdb

    SHA512

    0fcf110ccff218ff3d5cf712fda489e73a9fd103652350cda4c974f15c423fc20b21110b81ff94de45b6ac5a5837eea50c06ca54e44c662500c1c5a8e6f38c96

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.