Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2023, 21:06

General

  • Target

    2781b3209b36b385ac125836544fff3394376e5b17812bc0d7f9ea89c997e2c2.exe

  • Size

    1.3MB

  • MD5

    8827cdc197863cfa6cbadc731540832b

  • SHA1

    b96f9125b61a99afb83a6566f7feb11fd97ca305

  • SHA256

    2781b3209b36b385ac125836544fff3394376e5b17812bc0d7f9ea89c997e2c2

  • SHA512

    4f3cb6d7b5025463a1e8087c2e6ffe1e2186b7b18bea5b374894fabd69024cb03a1adb83aae498a826ce4160c226f23934e811f8ae8dc26e2c759ab62dbeb7f9

  • SSDEEP

    24576:ccURbdngEBJKuumfsEOJrpDI6mUfdRiETmqWVS6ZShnakTufpPBnkqrXepgfVYyc:ccURpgmJBr+JVIsdRi/MYBBnky3VRc

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Signatures

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2781b3209b36b385ac125836544fff3394376e5b17812bc0d7f9ea89c997e2c2.exe
    "C:\Users\Admin\AppData\Local\Temp\2781b3209b36b385ac125836544fff3394376e5b17812bc0d7f9ea89c997e2c2.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of AdjustPrivilegeToken
    PID:4344

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4344-132-0x0000000000400000-0x0000000000558000-memory.dmp

    Filesize

    1.3MB

  • memory/4344-133-0x00000000036C0000-0x00000000036D0000-memory.dmp

    Filesize

    64KB

  • memory/4344-139-0x0000000003860000-0x0000000003870000-memory.dmp

    Filesize

    64KB

  • memory/4344-145-0x0000000004310000-0x0000000004318000-memory.dmp

    Filesize

    32KB

  • memory/4344-146-0x0000000004330000-0x0000000004338000-memory.dmp

    Filesize

    32KB

  • memory/4344-147-0x00000000043D0000-0x00000000043D8000-memory.dmp

    Filesize

    32KB

  • memory/4344-148-0x0000000004660000-0x0000000004668000-memory.dmp

    Filesize

    32KB

  • memory/4344-149-0x0000000004680000-0x0000000004688000-memory.dmp

    Filesize

    32KB

  • memory/4344-150-0x0000000004A20000-0x0000000004A28000-memory.dmp

    Filesize

    32KB

  • memory/4344-151-0x0000000004920000-0x0000000004928000-memory.dmp

    Filesize

    32KB

  • memory/4344-152-0x0000000004790000-0x0000000004798000-memory.dmp

    Filesize

    32KB

  • memory/4344-153-0x0000000004330000-0x0000000004338000-memory.dmp

    Filesize

    32KB

  • memory/4344-154-0x0000000004790000-0x0000000004798000-memory.dmp

    Filesize

    32KB

  • memory/4344-155-0x00000000048C0000-0x00000000048C8000-memory.dmp

    Filesize

    32KB

  • memory/4344-156-0x0000000004330000-0x0000000004338000-memory.dmp

    Filesize

    32KB

  • memory/4344-157-0x00000000048C0000-0x00000000048C8000-memory.dmp

    Filesize

    32KB

  • memory/4344-158-0x0000000004790000-0x0000000004798000-memory.dmp

    Filesize

    32KB

  • memory/4344-185-0x00000000042B0000-0x00000000042B8000-memory.dmp

    Filesize

    32KB

  • memory/4344-186-0x00000000042C0000-0x00000000042C8000-memory.dmp

    Filesize

    32KB

  • memory/4344-187-0x0000000004440000-0x0000000004448000-memory.dmp

    Filesize

    32KB

  • memory/4344-188-0x0000000004450000-0x0000000004458000-memory.dmp

    Filesize

    32KB

  • memory/4344-190-0x0000000004450000-0x0000000004458000-memory.dmp

    Filesize

    32KB