Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
251s -
max time network
255s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-es -
resource tags
-
submitted
15/06/2023, 19:40
Errors
General
-
Target
Fact_digital_SerieA3548510694BSMULRBDPLatksj.exe
-
Size
248.3MB
-
MD5
4bc1ec0fe883af3a84a07a383f51695e
-
SHA1
86092d7158be3000924f82911de5edb19de8141c
-
SHA256
e07dd6c0c929cc8c6fb1c379e272a458776c5bbb2a3963c0baf5b2a71b53d079
-
SHA512
85a64eb4cbe7c387c14b7e3951a8428ecb6e8516fdacdc0b2bfaecf30a5d91b963db23fd6fdd93c630413ab1896e1befa548c8f2a652025843eb22e7ae18d3e4
-
SSDEEP
98304:qfIAyucjzAPt/4nFtbO8ZXaMxjR3zm737wOOAsGywW1UrttJjUI+:oIAy70/KXaMhxM7TXASttJo
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fact_digital_SerieA3548510694BSMULRBDPLatksj.exe"C:\Users\Admin\AppData\Local\Temp\Fact_digital_SerieA3548510694BSMULRBDPLatksj.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\xoiqbEssentialDriverDetect\xoibDriverMaintenanceProvkTouchMaster.exe"C:\ProgramData\xoiqbEssentialDriverDetect\xoibDriverMaintenanceProvkTouchMaster.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C powershell.exe -Command ""Set-ItemProperty -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\Run -Name AMDDigitalSyncH#(31#D8=3 -Value 'C:\ProgramData\xoiqbEssentialDriverDetect\xoibDriverMaintenanceProvkTouchMaster.exe /runas'""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""Set-ItemProperty -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\Run -Name AMDDigitalSyncH#(31#D8=3 -Value 'C:\ProgramData\xoiqbEssentialDriverDetect\xoibDriverMaintenanceProvkTouchMaster.exe /runas'""4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39fa855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
318.8MB
MD558008d537956c1ffab3f46262560bc4e
SHA144f2760720f4dd6a25ef12531cc7c29b9d864c94
SHA25695811fe68abd63cedd62336124c1a650eecf5d6377b8313227b0a581934cc391
SHA512f0006328ee46b9da4917ef07982d50fbba9618d6b8bf9c857072141294455cdf6d09196ed896fe3e9c05f57e2468cf8c618e81e265af0148b5090a689ecdce87
-
Filesize
318.8MB
MD558008d537956c1ffab3f46262560bc4e
SHA144f2760720f4dd6a25ef12531cc7c29b9d864c94
SHA25695811fe68abd63cedd62336124c1a650eecf5d6377b8313227b0a581934cc391
SHA512f0006328ee46b9da4917ef07982d50fbba9618d6b8bf9c857072141294455cdf6d09196ed896fe3e9c05f57e2468cf8c618e81e265af0148b5090a689ecdce87
-
Filesize
318.8MB
MD558008d537956c1ffab3f46262560bc4e
SHA144f2760720f4dd6a25ef12531cc7c29b9d864c94
SHA25695811fe68abd63cedd62336124c1a650eecf5d6377b8313227b0a581934cc391
SHA512f0006328ee46b9da4917ef07982d50fbba9618d6b8bf9c857072141294455cdf6d09196ed896fe3e9c05f57e2468cf8c618e81e265af0148b5090a689ecdce87
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
332B
MD537acf90e8c38228f0531ee835830c4b1
SHA163c03f4875e79d9e190c6d6448e95939b56eff50
SHA256bdd3d1e093277012d644023516cb6ccf776301f82e0fce0b0aa182c4c2fbf5cb
SHA5120a54ee07f9c2c6410df41383bb5785e430053f7e28dc2fb7563e6259d4ff6cf5139c94d118001b268b340f187cab155b0f4c07cb04fa80d5a6cf1a17c13aba4b
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
520KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
120KB
-
Filesize
216KB