Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 13:32

General

  • Target

    36c0ebc42d89064ae5d10675a96e9035_JC.exe

  • Size

    80KB

  • MD5

    36c0ebc42d89064ae5d10675a96e9035

  • SHA1

    9036a9856ed2f0238c16957595a8b97d4c716da1

  • SHA256

    84bc517807aff4e43d7d92b595bdd58d4a1cb4db8b5a93cffadd2ca90f434fca

  • SHA512

    d502660d82dd2e509954bc939221e7d361153654fa781dce8c2b39d480d4a8aa72fd0cc80c6a25961cdbe7ff1697c30217d8313a8e53392bbce356b987b27a4e

  • SSDEEP

    1536:nWzl8kvLb/vtV3rBb2dqR2LOS5DUHRbPa9b6i+sIk:slNPl2nOS5DSCopsIk

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 10 IoCs
  • Drops file in System32 directory 9 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36c0ebc42d89064ae5d10675a96e9035_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\36c0ebc42d89064ae5d10675a96e9035_JC.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2600
    • C:\Windows\SysWOW64\Ejhlgaeh.exe
      C:\Windows\system32\Ejhlgaeh.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\SysWOW64\Echfaf32.exe
        C:\Windows\system32\Echfaf32.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Windows\SysWOW64\Fkckeh32.exe
          C:\Windows\system32\Fkckeh32.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2544
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 140
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:2672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Echfaf32.exe

    Filesize

    80KB

    MD5

    dda35a5ce60fc8601fb2e85cc910316e

    SHA1

    56edc79cc0f5fd536893a0b233e7f8c0ef8938b4

    SHA256

    74e293639c48829dcff59d5e687fef428d034a866ee241270aa4a69a5474b784

    SHA512

    0e80694012824c90a7b17f049747558e3b3580c4a167956d3cd094dd930a05ac6f382a84ee30ec82ecf75e3d5c902d81cb1badff99e773adf63cee554caa982b

  • C:\Windows\SysWOW64\Echfaf32.exe

    Filesize

    80KB

    MD5

    dda35a5ce60fc8601fb2e85cc910316e

    SHA1

    56edc79cc0f5fd536893a0b233e7f8c0ef8938b4

    SHA256

    74e293639c48829dcff59d5e687fef428d034a866ee241270aa4a69a5474b784

    SHA512

    0e80694012824c90a7b17f049747558e3b3580c4a167956d3cd094dd930a05ac6f382a84ee30ec82ecf75e3d5c902d81cb1badff99e773adf63cee554caa982b

  • C:\Windows\SysWOW64\Echfaf32.exe

    Filesize

    80KB

    MD5

    dda35a5ce60fc8601fb2e85cc910316e

    SHA1

    56edc79cc0f5fd536893a0b233e7f8c0ef8938b4

    SHA256

    74e293639c48829dcff59d5e687fef428d034a866ee241270aa4a69a5474b784

    SHA512

    0e80694012824c90a7b17f049747558e3b3580c4a167956d3cd094dd930a05ac6f382a84ee30ec82ecf75e3d5c902d81cb1badff99e773adf63cee554caa982b

  • C:\Windows\SysWOW64\Ejhlgaeh.exe

    Filesize

    80KB

    MD5

    a4965d0be9d85c339d05ccb6afbcfa1b

    SHA1

    aafd46eca5d93984514ed21066a74bd5c8de7cf1

    SHA256

    75278c9f0d4d2963c75cbdbdc7fe74fa77f66cae9cf72de723410845457d259d

    SHA512

    75c97b66e630c43ea4508da73e76781ce53f8661f88b786588471d2224322dad5b435a9838c6a1468baf9715f8cc101b3056debfcd441978e6f5befded9c5c74

  • C:\Windows\SysWOW64\Ejhlgaeh.exe

    Filesize

    80KB

    MD5

    a4965d0be9d85c339d05ccb6afbcfa1b

    SHA1

    aafd46eca5d93984514ed21066a74bd5c8de7cf1

    SHA256

    75278c9f0d4d2963c75cbdbdc7fe74fa77f66cae9cf72de723410845457d259d

    SHA512

    75c97b66e630c43ea4508da73e76781ce53f8661f88b786588471d2224322dad5b435a9838c6a1468baf9715f8cc101b3056debfcd441978e6f5befded9c5c74

  • C:\Windows\SysWOW64\Ejhlgaeh.exe

    Filesize

    80KB

    MD5

    a4965d0be9d85c339d05ccb6afbcfa1b

    SHA1

    aafd46eca5d93984514ed21066a74bd5c8de7cf1

    SHA256

    75278c9f0d4d2963c75cbdbdc7fe74fa77f66cae9cf72de723410845457d259d

    SHA512

    75c97b66e630c43ea4508da73e76781ce53f8661f88b786588471d2224322dad5b435a9838c6a1468baf9715f8cc101b3056debfcd441978e6f5befded9c5c74

  • C:\Windows\SysWOW64\Fkckeh32.exe

    Filesize

    80KB

    MD5

    95fcf0f4aef80f36f7c0e4822b633027

    SHA1

    788237bdaeeef2317a39dba6c1dc509497eed1b9

    SHA256

    396d4455b050d91206ab3aa61d4f52bc7e4db3eca5bcbbb0b08e897efc264ecc

    SHA512

    cac58e6c8557f7018fec0479da59f7e721ffe617217d545cbdee16ac2e60eb9d575673f5b4b1e99377b8dc86bee61f1786e1ab53fe7c1e5ad0310960a8bb2f94

  • C:\Windows\SysWOW64\Fkckeh32.exe

    Filesize

    80KB

    MD5

    95fcf0f4aef80f36f7c0e4822b633027

    SHA1

    788237bdaeeef2317a39dba6c1dc509497eed1b9

    SHA256

    396d4455b050d91206ab3aa61d4f52bc7e4db3eca5bcbbb0b08e897efc264ecc

    SHA512

    cac58e6c8557f7018fec0479da59f7e721ffe617217d545cbdee16ac2e60eb9d575673f5b4b1e99377b8dc86bee61f1786e1ab53fe7c1e5ad0310960a8bb2f94

  • \Windows\SysWOW64\Echfaf32.exe

    Filesize

    80KB

    MD5

    dda35a5ce60fc8601fb2e85cc910316e

    SHA1

    56edc79cc0f5fd536893a0b233e7f8c0ef8938b4

    SHA256

    74e293639c48829dcff59d5e687fef428d034a866ee241270aa4a69a5474b784

    SHA512

    0e80694012824c90a7b17f049747558e3b3580c4a167956d3cd094dd930a05ac6f382a84ee30ec82ecf75e3d5c902d81cb1badff99e773adf63cee554caa982b

  • \Windows\SysWOW64\Echfaf32.exe

    Filesize

    80KB

    MD5

    dda35a5ce60fc8601fb2e85cc910316e

    SHA1

    56edc79cc0f5fd536893a0b233e7f8c0ef8938b4

    SHA256

    74e293639c48829dcff59d5e687fef428d034a866ee241270aa4a69a5474b784

    SHA512

    0e80694012824c90a7b17f049747558e3b3580c4a167956d3cd094dd930a05ac6f382a84ee30ec82ecf75e3d5c902d81cb1badff99e773adf63cee554caa982b

  • \Windows\SysWOW64\Ejhlgaeh.exe

    Filesize

    80KB

    MD5

    a4965d0be9d85c339d05ccb6afbcfa1b

    SHA1

    aafd46eca5d93984514ed21066a74bd5c8de7cf1

    SHA256

    75278c9f0d4d2963c75cbdbdc7fe74fa77f66cae9cf72de723410845457d259d

    SHA512

    75c97b66e630c43ea4508da73e76781ce53f8661f88b786588471d2224322dad5b435a9838c6a1468baf9715f8cc101b3056debfcd441978e6f5befded9c5c74

  • \Windows\SysWOW64\Ejhlgaeh.exe

    Filesize

    80KB

    MD5

    a4965d0be9d85c339d05ccb6afbcfa1b

    SHA1

    aafd46eca5d93984514ed21066a74bd5c8de7cf1

    SHA256

    75278c9f0d4d2963c75cbdbdc7fe74fa77f66cae9cf72de723410845457d259d

    SHA512

    75c97b66e630c43ea4508da73e76781ce53f8661f88b786588471d2224322dad5b435a9838c6a1468baf9715f8cc101b3056debfcd441978e6f5befded9c5c74

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    80KB

    MD5

    95fcf0f4aef80f36f7c0e4822b633027

    SHA1

    788237bdaeeef2317a39dba6c1dc509497eed1b9

    SHA256

    396d4455b050d91206ab3aa61d4f52bc7e4db3eca5bcbbb0b08e897efc264ecc

    SHA512

    cac58e6c8557f7018fec0479da59f7e721ffe617217d545cbdee16ac2e60eb9d575673f5b4b1e99377b8dc86bee61f1786e1ab53fe7c1e5ad0310960a8bb2f94

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    80KB

    MD5

    95fcf0f4aef80f36f7c0e4822b633027

    SHA1

    788237bdaeeef2317a39dba6c1dc509497eed1b9

    SHA256

    396d4455b050d91206ab3aa61d4f52bc7e4db3eca5bcbbb0b08e897efc264ecc

    SHA512

    cac58e6c8557f7018fec0479da59f7e721ffe617217d545cbdee16ac2e60eb9d575673f5b4b1e99377b8dc86bee61f1786e1ab53fe7c1e5ad0310960a8bb2f94

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    80KB

    MD5

    95fcf0f4aef80f36f7c0e4822b633027

    SHA1

    788237bdaeeef2317a39dba6c1dc509497eed1b9

    SHA256

    396d4455b050d91206ab3aa61d4f52bc7e4db3eca5bcbbb0b08e897efc264ecc

    SHA512

    cac58e6c8557f7018fec0479da59f7e721ffe617217d545cbdee16ac2e60eb9d575673f5b4b1e99377b8dc86bee61f1786e1ab53fe7c1e5ad0310960a8bb2f94

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    80KB

    MD5

    95fcf0f4aef80f36f7c0e4822b633027

    SHA1

    788237bdaeeef2317a39dba6c1dc509497eed1b9

    SHA256

    396d4455b050d91206ab3aa61d4f52bc7e4db3eca5bcbbb0b08e897efc264ecc

    SHA512

    cac58e6c8557f7018fec0479da59f7e721ffe617217d545cbdee16ac2e60eb9d575673f5b4b1e99377b8dc86bee61f1786e1ab53fe7c1e5ad0310960a8bb2f94

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    80KB

    MD5

    95fcf0f4aef80f36f7c0e4822b633027

    SHA1

    788237bdaeeef2317a39dba6c1dc509497eed1b9

    SHA256

    396d4455b050d91206ab3aa61d4f52bc7e4db3eca5bcbbb0b08e897efc264ecc

    SHA512

    cac58e6c8557f7018fec0479da59f7e721ffe617217d545cbdee16ac2e60eb9d575673f5b4b1e99377b8dc86bee61f1786e1ab53fe7c1e5ad0310960a8bb2f94

  • \Windows\SysWOW64\Fkckeh32.exe

    Filesize

    80KB

    MD5

    95fcf0f4aef80f36f7c0e4822b633027

    SHA1

    788237bdaeeef2317a39dba6c1dc509497eed1b9

    SHA256

    396d4455b050d91206ab3aa61d4f52bc7e4db3eca5bcbbb0b08e897efc264ecc

    SHA512

    cac58e6c8557f7018fec0479da59f7e721ffe617217d545cbdee16ac2e60eb9d575673f5b4b1e99377b8dc86bee61f1786e1ab53fe7c1e5ad0310960a8bb2f94

  • memory/2544-47-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2600-12-0x0000000000220000-0x000000000025E000-memory.dmp

    Filesize

    248KB

  • memory/2600-0-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2600-46-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2600-6-0x0000000000220000-0x000000000025E000-memory.dmp

    Filesize

    248KB

  • memory/2612-33-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2612-36-0x00000000002E0000-0x000000000031E000-memory.dmp

    Filesize

    248KB

  • memory/2656-20-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/2656-26-0x0000000000290000-0x00000000002CE000-memory.dmp

    Filesize

    248KB