Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 10:53
Behavioral task
behavioral1
Sample
f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe
Resource
win10v2004-20221111-en
General
-
Target
f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe
-
Size
1.2MB
-
MD5
50d6d056d37286459f212b113980250f
-
SHA1
9d2c0de2035562c68347fda6c56e63317e48eb95
-
SHA256
f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981
-
SHA512
7f94c99d26a89592abd150ef591ac3edfc3415a55b1324c0055aa9fa13ce047a203fa84d3cc77434c89bb6b530a2639ef2d0e22b40e385c8d26eae3db4d22128
-
SSDEEP
24576:5jaMGBp93MJhX8SSedtby5tnebTWPfFgo1FXegOWUmNRAZGeA:AP8b9twebSuoqg5IUeA
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\system32\drivers\etc\hosts f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe -
resource yara_rule behavioral2/memory/3876-132-0x0000000000400000-0x0000000000674000-memory.dmp vmprotect behavioral2/memory/3876-133-0x0000000000400000-0x0000000000674000-memory.dmp vmprotect behavioral2/memory/3876-136-0x0000000000400000-0x0000000000674000-memory.dmp vmprotect -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://h1.ripway.com/buscador/BuscadorTotal.htm" f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3876 f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe 3876 f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe 3876 f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe"C:\Users\Admin\AppData\Local\Temp\f48253782435cab585b6ce4dc25712f427009dbe5c67a7b237cc875c80601981.exe"1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
PID:3876