Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2022, 00:02

General

  • Target

    FenixZone Downloader Global.exe

  • Size

    2.2MB

  • MD5

    f4acc9bd9e1c3b1bcdde1420d72880ef

  • SHA1

    280027cc243533d7c45abe3f4ac580075ff265af

  • SHA256

    df07f5c894dc5b6ccc61c42603d97d2011d24fa33164d6c0e717e937cc70e86c

  • SHA512

    88212d1c47d8a572d67765e6bd8e97ae9bc16a78fea47935e96f20743ae42c57e0a53be321c23f798d802cf61dd54c6f383d4fbf31f029fc01772689b230188e

  • SSDEEP

    24576:sahCKYyreWEELzQeRV4eCKNLeTThbx9RwY62yB1IUYUBsjkbeAvmTKXqsL074byN:PvreNELzQdOQYu9ypweOQYu9ypFLzQ

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FenixZone Downloader Global.exe
    "C:\Users\Admin\AppData\Local\Temp\FenixZone Downloader Global.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\Documents\GTA SA\VC_redist.x86.exe
      "C:\Users\Admin\Documents\GTA SA\VC_redist.x86.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1492
      • C:\Windows\Temp\{AEFF10B0-5DDF-4C3E-823F-EE916D9FC8D3}\.cr\VC_redist.x86.exe
        "C:\Windows\Temp\{AEFF10B0-5DDF-4C3E-823F-EE916D9FC8D3}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\Documents\GTA SA\VC_redist.x86.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1636
    • C:\Users\Admin\Documents\GTA SA\DirectX\DXSETUP.exe
      "C:\Users\Admin\Documents\GTA SA\DirectX\DXSETUP.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1684

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Documents\GTA SA\DirectX\DSETUP32.DLL

    Filesize

    1.5MB

    MD5

    d8fa7bb4fe10251a239ed75055dd6f73

    SHA1

    76c4bd2d8f359f7689415efc15e3743d35673ae8

    SHA256

    fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8

    SHA512

    73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4

  • C:\Users\Admin\Documents\GTA SA\DirectX\DXSETUP.exe

    Filesize

    505KB

    MD5

    bf3f290275c21bdd3951955c9c3cf32c

    SHA1

    9fd00f3bb8a870112dae464f555fcd5e7f9200c0

    SHA256

    8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d

    SHA512

    d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249

  • C:\Users\Admin\Documents\GTA SA\DirectX\dsetup.dll

    Filesize

    93KB

    MD5

    eb701def7d0809e8da765a752ab42be5

    SHA1

    7897418f0fae737a3ebe4f7954118d71c6c8b426

    SHA256

    2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

    SHA512

    6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

  • C:\Users\Admin\Documents\GTA SA\VC_redist.x86.exe

    Filesize

    13.1MB

    MD5

    44b4932dad3cbb8ce7af149a3c155ef9

    SHA1

    0a16910fd763eed7fc89bfa329ad2ffc317431e8

    SHA256

    80c7969f4e05002a0cd820b746e0acb7406d4b85e52ef096707315b390927824

    SHA512

    ca71e2024336136ee4e0a4cdf03ab9a035e9276f5f2eeb45349b3e78bbd5c1185e5cbf4e8e1872ed7495e0ae5941be0bb635cfeb0b2b0f0108225938bbb111be

  • C:\Users\Admin\Documents\GTA SA\VC_redist.x86.exe

    Filesize

    13.1MB

    MD5

    44b4932dad3cbb8ce7af149a3c155ef9

    SHA1

    0a16910fd763eed7fc89bfa329ad2ffc317431e8

    SHA256

    80c7969f4e05002a0cd820b746e0acb7406d4b85e52ef096707315b390927824

    SHA512

    ca71e2024336136ee4e0a4cdf03ab9a035e9276f5f2eeb45349b3e78bbd5c1185e5cbf4e8e1872ed7495e0ae5941be0bb635cfeb0b2b0f0108225938bbb111be

  • C:\Windows\Temp\{AEFF10B0-5DDF-4C3E-823F-EE916D9FC8D3}\.cr\VC_redist.x86.exe

    Filesize

    632KB

    MD5

    7e212a2f2562a1298132e291923a1e89

    SHA1

    c0f57264a66998164270b741e3c6f842652bdad7

    SHA256

    a0b8aabc7e5e2b1ac791b869ec8ba074c2ffe27d8c715fc8d7aa4c522cd1ee7c

    SHA512

    1f461bbd32e2ede80f7da13eed744581d5f7b2d63b252e7ebbc5bcb1e5139ed9000f110dcae711ba8d22ea66d8e2b6739258b6b8edc960e04a804bdd99568adb

  • C:\Windows\Temp\{AEFF10B0-5DDF-4C3E-823F-EE916D9FC8D3}\.cr\VC_redist.x86.exe

    Filesize

    632KB

    MD5

    7e212a2f2562a1298132e291923a1e89

    SHA1

    c0f57264a66998164270b741e3c6f842652bdad7

    SHA256

    a0b8aabc7e5e2b1ac791b869ec8ba074c2ffe27d8c715fc8d7aa4c522cd1ee7c

    SHA512

    1f461bbd32e2ede80f7da13eed744581d5f7b2d63b252e7ebbc5bcb1e5139ed9000f110dcae711ba8d22ea66d8e2b6739258b6b8edc960e04a804bdd99568adb

  • \Users\Admin\Documents\GTA SA\DirectX\DSETUP.dll

    Filesize

    93KB

    MD5

    eb701def7d0809e8da765a752ab42be5

    SHA1

    7897418f0fae737a3ebe4f7954118d71c6c8b426

    SHA256

    2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

    SHA512

    6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

  • \Users\Admin\Documents\GTA SA\DirectX\DSETUP.dll

    Filesize

    93KB

    MD5

    eb701def7d0809e8da765a752ab42be5

    SHA1

    7897418f0fae737a3ebe4f7954118d71c6c8b426

    SHA256

    2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f

    SHA512

    6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f

  • \Users\Admin\Documents\GTA SA\DirectX\DXSETUP.exe

    Filesize

    505KB

    MD5

    bf3f290275c21bdd3951955c9c3cf32c

    SHA1

    9fd00f3bb8a870112dae464f555fcd5e7f9200c0

    SHA256

    8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d

    SHA512

    d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249

  • \Users\Admin\Documents\GTA SA\DirectX\dsetup32.dll

    Filesize

    1.5MB

    MD5

    d8fa7bb4fe10251a239ed75055dd6f73

    SHA1

    76c4bd2d8f359f7689415efc15e3743d35673ae8

    SHA256

    fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8

    SHA512

    73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4

  • \Users\Admin\Documents\GTA SA\VC_redist.x86.exe

    Filesize

    13.1MB

    MD5

    44b4932dad3cbb8ce7af149a3c155ef9

    SHA1

    0a16910fd763eed7fc89bfa329ad2ffc317431e8

    SHA256

    80c7969f4e05002a0cd820b746e0acb7406d4b85e52ef096707315b390927824

    SHA512

    ca71e2024336136ee4e0a4cdf03ab9a035e9276f5f2eeb45349b3e78bbd5c1185e5cbf4e8e1872ed7495e0ae5941be0bb635cfeb0b2b0f0108225938bbb111be

  • \Windows\Temp\{6041431F-C071-419A-B3CD-D5417DAD5730}\.ba\wixstdba.dll

    Filesize

    191KB

    MD5

    eab9caf4277829abdf6223ec1efa0edd

    SHA1

    74862ecf349a9bedd32699f2a7a4e00b4727543d

    SHA256

    a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

    SHA512

    45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

  • \Windows\Temp\{AEFF10B0-5DDF-4C3E-823F-EE916D9FC8D3}\.cr\VC_redist.x86.exe

    Filesize

    632KB

    MD5

    7e212a2f2562a1298132e291923a1e89

    SHA1

    c0f57264a66998164270b741e3c6f842652bdad7

    SHA256

    a0b8aabc7e5e2b1ac791b869ec8ba074c2ffe27d8c715fc8d7aa4c522cd1ee7c

    SHA512

    1f461bbd32e2ede80f7da13eed744581d5f7b2d63b252e7ebbc5bcb1e5139ed9000f110dcae711ba8d22ea66d8e2b6739258b6b8edc960e04a804bdd99568adb

  • memory/1636-78-0x000000006EBF1000-0x000000006EBF3000-memory.dmp

    Filesize

    8KB

  • memory/1672-57-0x0000000004A95000-0x0000000004AA6000-memory.dmp

    Filesize

    68KB

  • memory/1672-54-0x0000000001350000-0x0000000001594000-memory.dmp

    Filesize

    2.3MB

  • memory/1672-56-0x0000000004A95000-0x0000000004AA6000-memory.dmp

    Filesize

    68KB

  • memory/1672-55-0x0000000075111000-0x0000000075113000-memory.dmp

    Filesize

    8KB