Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
74s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2023, 06:01
Static task
static1
Behavioral task
behavioral1
Sample
bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe
Resource
win10-20230703-en
Behavioral task
behavioral2
Sample
bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe
Resource
win10v2004-20230703-en
General
-
Target
bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe
-
Size
138KB
-
MD5
f62bb82db62dd6b80908dcd79ea51fb2
-
SHA1
e635ba1b935adf31ffd055d71884098567b3dd4f
-
SHA256
bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
-
SHA512
869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
SSDEEP
3072:dsFd0klDWOsja1mrT0CowNJ8s540uUf0WccH2hgcD:QWHrYNwNeQEBgc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4100 RthfOCoLflan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs net.exe
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1548 wrote to memory of 4100 1548 bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe 90 PID 1548 wrote to memory of 4100 1548 bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe"C:\Users\Admin\AppData\Local\Temp\bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\RthfOCoLflan.exe"C:\Users\Admin\AppData\Local\Temp\RthfOCoLflan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:4100
-
-
C:\Users\Admin\AppData\Local\Temp\BiefZxsFBlan.exe"C:\Users\Admin\AppData\Local\Temp\BiefZxsFBlan.exe" 8 LAN2⤵PID:2544
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵PID:3296
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:764
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:3324
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:4440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138KB
MD5f62bb82db62dd6b80908dcd79ea51fb2
SHA1e635ba1b935adf31ffd055d71884098567b3dd4f
SHA256bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
SHA512869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
Filesize
138KB
MD5f62bb82db62dd6b80908dcd79ea51fb2
SHA1e635ba1b935adf31ffd055d71884098567b3dd4f
SHA256bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
SHA512869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
Filesize
138KB
MD5f62bb82db62dd6b80908dcd79ea51fb2
SHA1e635ba1b935adf31ffd055d71884098567b3dd4f
SHA256bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
SHA512869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
Filesize
138KB
MD5f62bb82db62dd6b80908dcd79ea51fb2
SHA1e635ba1b935adf31ffd055d71884098567b3dd4f
SHA256bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
SHA512869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08
-
Filesize
138KB
MD5f62bb82db62dd6b80908dcd79ea51fb2
SHA1e635ba1b935adf31ffd055d71884098567b3dd4f
SHA256bf575ce1c9425bc44f5cabbc34366e0e92ef369db0a8b69942c5bdb1cca9b800
SHA512869863239f231d3bea636a98f7adb8d6f04f60fb2cacc5ef8d8d87bfaf327abc57668e0cc1e8f10adcb7156646ff75ff67fb3f06f22b25797220eccd91b93e08