Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2022, 09:26

General

  • Target

    0b7d3217ae50a0433b3a96494d089e05.exe

  • Size

    1.1MB

  • MD5

    0b7d3217ae50a0433b3a96494d089e05

  • SHA1

    012822d29e1ec200b9cf23e10cb0d8a380ec4da6

  • SHA256

    89609c41c0c13302695dec877a6863737243e22b414740e0595f62a0c4d1362a

  • SHA512

    14a2558b3b56fa9f0f1c31dfe2d65cb5b2574c72f16240b94a642be738d1df49d212ebd94a2440aa8c32ba99d2c5876b632a69027615021f2a5bcc552b8d0888

  • SSDEEP

    24576:6AbXH84DRnKCwyElWCAMmKix1x1IDStOX2cBZ8umx7QgbcxWsG2Emy:DL8uokzK6DxcD8uqzbcxWX/my

Malware Config

Extracted

Family

ffdroider

C2

http://103.136.42.153

Signatures

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b7d3217ae50a0433b3a96494d089e05.exe
    "C:\Users\Admin\AppData\Local\Temp\0b7d3217ae50a0433b3a96494d089e05.exe"
    1⤵
    • Modifies system executable filetype association
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4548
    • C:\Users\Admin\AppData\Local\Temp\3582-490\0b7d3217ae50a0433b3a96494d089e05.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\0b7d3217ae50a0433b3a96494d089e05.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      PID:4800

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3582-490\0b7d3217ae50a0433b3a96494d089e05.exe

    Filesize

    1.1MB

    MD5

    78c42d6817af1ad96cabdf6ff2f7f3da

    SHA1

    abeadcee8d9f00c6ccdb0f9d33edd1006a079384

    SHA256

    38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

    SHA512

    76a3b3e6ae0ea0f17661314fe391ec8b9b580a7ecfee0ebe2d830db3843d5d929d6bf3adb8cb03f6b87212a607ce001700ea3dc305828c817ff017dd3b766811

  • C:\Users\Admin\AppData\Local\Temp\3582-490\0b7d3217ae50a0433b3a96494d089e05.exe

    Filesize

    1.1MB

    MD5

    78c42d6817af1ad96cabdf6ff2f7f3da

    SHA1

    abeadcee8d9f00c6ccdb0f9d33edd1006a079384

    SHA256

    38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

    SHA512

    76a3b3e6ae0ea0f17661314fe391ec8b9b580a7ecfee0ebe2d830db3843d5d929d6bf3adb8cb03f6b87212a607ce001700ea3dc305828c817ff017dd3b766811

  • C:\Users\Admin\DOCUME~1\VLCPVI~1.1\0B7D32~1.EXE

    Filesize

    1.1MB

    MD5

    5af08e991075f2c1d19f2c434760afe3

    SHA1

    32ae27ef209e6b5f7acd937483905c84e3d1b62c

    SHA256

    6ac6fd0db8e4dad3a7d57835e7cc8e6a836491f988b521cc6d919c2bab565cfe

    SHA512

    389b4ba4e6817dc9c68d9ef19d676b3278c4f4559e87ba885ae57e4974dfbb2b1a24bf055e2a6e24a0432b20376e6ea075273b975b88a93fb57aa0a98b71e075

  • memory/4800-152-0x0000000005070000-0x0000000005078000-memory.dmp

    Filesize

    32KB

  • memory/4800-154-0x0000000005250000-0x0000000005258000-memory.dmp

    Filesize

    32KB

  • memory/4800-137-0x0000000000FB0000-0x000000000124E000-memory.dmp

    Filesize

    2.6MB

  • memory/4800-138-0x0000000000FB0000-0x000000000124E000-memory.dmp

    Filesize

    2.6MB

  • memory/4800-139-0x00000000043D0000-0x00000000043E0000-memory.dmp

    Filesize

    64KB

  • memory/4800-145-0x0000000004570000-0x0000000004580000-memory.dmp

    Filesize

    64KB

  • memory/4800-151-0x0000000005050000-0x0000000005058000-memory.dmp

    Filesize

    32KB

  • memory/4800-135-0x0000000000FB0000-0x000000000124E000-memory.dmp

    Filesize

    2.6MB

  • memory/4800-153-0x0000000005110000-0x0000000005118000-memory.dmp

    Filesize

    32KB

  • memory/4800-136-0x0000000000FB0000-0x000000000124E000-memory.dmp

    Filesize

    2.6MB

  • memory/4800-155-0x0000000005270000-0x0000000005278000-memory.dmp

    Filesize

    32KB

  • memory/4800-156-0x0000000005520000-0x0000000005528000-memory.dmp

    Filesize

    32KB

  • memory/4800-157-0x0000000005420000-0x0000000005428000-memory.dmp

    Filesize

    32KB

  • memory/4800-158-0x0000000005290000-0x0000000005298000-memory.dmp

    Filesize

    32KB

  • memory/4800-159-0x0000000005070000-0x0000000005078000-memory.dmp

    Filesize

    32KB

  • memory/4800-160-0x0000000005290000-0x0000000005298000-memory.dmp

    Filesize

    32KB

  • memory/4800-161-0x0000000005070000-0x0000000005078000-memory.dmp

    Filesize

    32KB

  • memory/4800-162-0x0000000005290000-0x0000000005298000-memory.dmp

    Filesize

    32KB

  • memory/4800-176-0x0000000000FB0000-0x000000000124E000-memory.dmp

    Filesize

    2.6MB