Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2023, 16:11
Static task
static1
Behavioral task
behavioral1
Sample
Fxhdglrvft_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Fxhdglrvft_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
Fxhdglrvft_JC.exe
-
Size
816KB
-
MD5
0d4d3fd81be90e306cfbbd19410b4134
-
SHA1
4c095ad2ac52fe9d4c74faa5b2e2e1c745d97d2e
-
SHA256
f588278291a1b869c7e0e713ed198607c393600515acfd60137e29bfdbfd4e9b
-
SHA512
ff8be8dabdd2ca5e07c65a6deb14ca96e5c44cf35977f221f58be91855d3e230c84b6dcec2dd5751eead0e4b05d08f9c8a7f42915591139d650c713dc5a34b4d
-
SSDEEP
12288:/jaydQ/TxFdbV+wonPGWRVc1gYnFaKVzJ3wSR8n5XhdPPMw:/uydCdbkRVc1gYnF/JJ4XDXM
Malware Config
Extracted
raccoon
7f44ae0b7f2c0c657163637ea9cf5563
http://194.213.18.158:80
http://144.217.220.122:80
Signatures
-
Raccoon Stealer payload 2 IoCs
resource yara_rule behavioral2/memory/1072-1090-0x0000000000400000-0x0000000000418000-memory.dmp family_raccoon behavioral2/memory/1072-1126-0x0000000000400000-0x0000000000418000-memory.dmp family_raccoon -
Downloads MZ/PE file
-
Loads dropped DLL 3 IoCs
pid Process 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Czviccna = "C:\\Users\\Admin\\AppData\\Roaming\\Czviccna.exe" Fxhdglrvft_JC.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2404 set thread context of 1072 2404 Fxhdglrvft_JC.exe 86 -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe 1072 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2404 Fxhdglrvft_JC.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2404 wrote to memory of 1072 2404 Fxhdglrvft_JC.exe 86 PID 2404 wrote to memory of 1072 2404 Fxhdglrvft_JC.exe 86 PID 2404 wrote to memory of 1072 2404 Fxhdglrvft_JC.exe 86 PID 2404 wrote to memory of 1072 2404 Fxhdglrvft_JC.exe 86 PID 2404 wrote to memory of 1072 2404 Fxhdglrvft_JC.exe 86 PID 2404 wrote to memory of 1072 2404 Fxhdglrvft_JC.exe 86 PID 2404 wrote to memory of 1072 2404 Fxhdglrvft_JC.exe 86 PID 2404 wrote to memory of 1072 2404 Fxhdglrvft_JC.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fxhdglrvft_JC.exe"C:\Users\Admin\AppData\Local\Temp\Fxhdglrvft_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
Filesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
Filesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1