Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    81s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 22:59

General

  • Target

    1d50d4bb6f2dd7af520b2d2aebc3fc98092752fad858cbc64860bbd3f42dc706.exe

  • Size

    260KB

  • MD5

    846f23d49c42a916ad27cf28997a24f0

  • SHA1

    d9d307c7a7c59d878d522bfce64c3ab1ea607478

  • SHA256

    1d50d4bb6f2dd7af520b2d2aebc3fc98092752fad858cbc64860bbd3f42dc706

  • SHA512

    22d2e48ce820621244802f6ec0417a512a5612c39d119d49f193ef25863d06f82fd682e2d00da5f9a0c0cfbd47f583eaf19633df01c2e78cb19b2c294a1e6dcd

  • SSDEEP

    6144:CDJVazMKV31FdaQvXluxqU+A/0y+nt75voqQEnHv0CxN8H9R/:CDJM/bXntAh+nhZoqQEHvVIz/

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies AppInit DLL entries 2 TTPs
  • Drops file in Program Files directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d50d4bb6f2dd7af520b2d2aebc3fc98092752fad858cbc64860bbd3f42dc706.exe
    "C:\Users\Admin\AppData\Local\Temp\1d50d4bb6f2dd7af520b2d2aebc3fc98092752fad858cbc64860bbd3f42dc706.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3272
  • C:\PROGRA~3\Mozilla\fmzgwvi.exe
    C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:2588

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\Mozilla\fmzgwvi.exe

    Filesize

    260KB

    MD5

    efb769515b34d90dc723d3ef88fdab70

    SHA1

    aaa18f7582d78a31345d8efe57649890d49ffac9

    SHA256

    90fd32cf8d5a5f4bdb04040d0c723d3a8ea3184e784a3db05fde5ade7fdcde24

    SHA512

    6f5b582150a283b55dd3ce619b7c156da662099a6b5c18288b64766e7fdf44b5de024f227ae331a8a5779576506297f8ac4069659fd93543728002688b37ec21

  • C:\ProgramData\Mozilla\fmzgwvi.exe

    Filesize

    260KB

    MD5

    efb769515b34d90dc723d3ef88fdab70

    SHA1

    aaa18f7582d78a31345d8efe57649890d49ffac9

    SHA256

    90fd32cf8d5a5f4bdb04040d0c723d3a8ea3184e784a3db05fde5ade7fdcde24

    SHA512

    6f5b582150a283b55dd3ce619b7c156da662099a6b5c18288b64766e7fdf44b5de024f227ae331a8a5779576506297f8ac4069659fd93543728002688b37ec21

  • memory/2588-141-0x00000000008D0000-0x000000000092B000-memory.dmp

    Filesize

    364KB

  • memory/2588-146-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3272-132-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3272-133-0x0000000000900000-0x000000000095B000-memory.dmp

    Filesize

    364KB

  • memory/3272-140-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB