Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

14/11/2023, 17:31

231114-v3qg7acf42 10

14/11/2023, 17:21

231114-vxdw7sdg61 10

28/10/2023, 19:29

231028-x7cs1age56 10

24/10/2023, 13:29

231024-qrn3rsdb6z 10

18/10/2023, 12:04

231018-n8ybnaeb31 10

07/09/2023, 12:10

230907-pce1wahe2x 10

Analysis

  • max time kernel
    600s
  • max time network
    447s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/10/2023, 13:29

General

  • Target

    fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe

  • Size

    1.9MB

  • MD5

    430c2b63372064c3e6d909635a12cfe9

  • SHA1

    992b607f528c0f9e59ace4fc83d6b0b999816c10

  • SHA256

    fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

  • SHA512

    9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

  • SSDEEP

    12288:RFfwcHcu8pMkZ3Fn9d+Vd3SUZ+7EeI1x7f7V3+hT6DaRWz58kc+1xy8SyiwPZ:RJcu8pl9d+VdCUhN1SsNK+1pSy1PZ

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 5 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 7 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe
    "C:\Users\Admin\AppData\Local\Temp\fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds policy Run key to start application
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Windows\SysWOW64\fservice.exe
      C:\Windows\system32\fservice.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\services.exe
        C:\Windows\services.exe -XP
        3⤵
        • Modifies WinLogon for persistence
        • Adds policy Run key to start application
        • Modifies Installed Components in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\Windows\SysWOW64\NET.exe
          NET STOP srservice
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1864
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 STOP srservice
            5⤵
              PID:4848
          • C:\Windows\SysWOW64\NET.exe
            NET STOP navapsvc
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3856
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 STOP navapsvc
              5⤵
                PID:3104
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe.bat
          2⤵
            PID:4456

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6.exe.bat

          Filesize

          133B

          MD5

          952c93295f56e73a6dd9cddf7c741481

          SHA1

          ff02a8139fdb21c4b3fd02c47127d55396f46b2b

          SHA256

          1db573e0788f16cbaa32fafc9afca99d1d7bb31417f8bd289c0ab06aa210aa91

          SHA512

          8acb4f590f07f8ea7ba03b2c7d7bba7c80468da43f13f3304143eac0cc7ce8dd2251f5fd558f3803d011f9f7cbf3489d032129ca50ba398d011108716fa7c3cd

        • C:\Windows\SysWOW64\fservice.exe

          Filesize

          1.9MB

          MD5

          430c2b63372064c3e6d909635a12cfe9

          SHA1

          992b607f528c0f9e59ace4fc83d6b0b999816c10

          SHA256

          fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

          SHA512

          9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

        • C:\Windows\SysWOW64\fservice.exe

          Filesize

          1.9MB

          MD5

          430c2b63372064c3e6d909635a12cfe9

          SHA1

          992b607f528c0f9e59ace4fc83d6b0b999816c10

          SHA256

          fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

          SHA512

          9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

        • C:\Windows\SysWOW64\fservice.exe

          Filesize

          1.9MB

          MD5

          430c2b63372064c3e6d909635a12cfe9

          SHA1

          992b607f528c0f9e59ace4fc83d6b0b999816c10

          SHA256

          fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

          SHA512

          9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

        • C:\Windows\SysWOW64\reginv.dll

          Filesize

          36KB

          MD5

          1c1bbc7f47da44d1ae156e532017b511

          SHA1

          88b67447eaba3cf18c225c7d66f3e132796f7581

          SHA256

          cd496284e4ae8828a24c19dc544e43f7bd508ad151ec0f88f76e5e4bff746607

          SHA512

          ef3c0c0fda117a6d618a1fa594dae6da39a92e09cc6b76d8ea35a33095fac378319affdf4b19dd5494ff99075ba5b2205991d7765ede36e22d4d83daf9bc5bdf

        • C:\Windows\SysWOW64\reginv.dll

          Filesize

          36KB

          MD5

          1c1bbc7f47da44d1ae156e532017b511

          SHA1

          88b67447eaba3cf18c225c7d66f3e132796f7581

          SHA256

          cd496284e4ae8828a24c19dc544e43f7bd508ad151ec0f88f76e5e4bff746607

          SHA512

          ef3c0c0fda117a6d618a1fa594dae6da39a92e09cc6b76d8ea35a33095fac378319affdf4b19dd5494ff99075ba5b2205991d7765ede36e22d4d83daf9bc5bdf

        • C:\Windows\SysWOW64\reginv.dll

          Filesize

          36KB

          MD5

          1c1bbc7f47da44d1ae156e532017b511

          SHA1

          88b67447eaba3cf18c225c7d66f3e132796f7581

          SHA256

          cd496284e4ae8828a24c19dc544e43f7bd508ad151ec0f88f76e5e4bff746607

          SHA512

          ef3c0c0fda117a6d618a1fa594dae6da39a92e09cc6b76d8ea35a33095fac378319affdf4b19dd5494ff99075ba5b2205991d7765ede36e22d4d83daf9bc5bdf

        • C:\Windows\SysWOW64\reginv.dll

          Filesize

          36KB

          MD5

          1c1bbc7f47da44d1ae156e532017b511

          SHA1

          88b67447eaba3cf18c225c7d66f3e132796f7581

          SHA256

          cd496284e4ae8828a24c19dc544e43f7bd508ad151ec0f88f76e5e4bff746607

          SHA512

          ef3c0c0fda117a6d618a1fa594dae6da39a92e09cc6b76d8ea35a33095fac378319affdf4b19dd5494ff99075ba5b2205991d7765ede36e22d4d83daf9bc5bdf

        • C:\Windows\SysWOW64\reginv.dll

          Filesize

          36KB

          MD5

          1c1bbc7f47da44d1ae156e532017b511

          SHA1

          88b67447eaba3cf18c225c7d66f3e132796f7581

          SHA256

          cd496284e4ae8828a24c19dc544e43f7bd508ad151ec0f88f76e5e4bff746607

          SHA512

          ef3c0c0fda117a6d618a1fa594dae6da39a92e09cc6b76d8ea35a33095fac378319affdf4b19dd5494ff99075ba5b2205991d7765ede36e22d4d83daf9bc5bdf

        • C:\Windows\SysWOW64\winkey.dll

          Filesize

          13KB

          MD5

          b4c72da9fd1a0dcb0698b7da97daa0cd

          SHA1

          b25a79e8ea4c723c58caab83aed6ea48de7ed759

          SHA256

          45d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f

          SHA512

          f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066

        • C:\Windows\services.exe

          Filesize

          1.9MB

          MD5

          430c2b63372064c3e6d909635a12cfe9

          SHA1

          992b607f528c0f9e59ace4fc83d6b0b999816c10

          SHA256

          fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

          SHA512

          9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

        • C:\Windows\services.exe

          Filesize

          1.9MB

          MD5

          430c2b63372064c3e6d909635a12cfe9

          SHA1

          992b607f528c0f9e59ace4fc83d6b0b999816c10

          SHA256

          fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

          SHA512

          9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

        • C:\Windows\system\sservice.exe

          Filesize

          1.9MB

          MD5

          430c2b63372064c3e6d909635a12cfe9

          SHA1

          992b607f528c0f9e59ace4fc83d6b0b999816c10

          SHA256

          fffd0cdd4935b9fa1ff5530a94ec648346d5f6c6521fc07641fd9254f5ef75d6

          SHA512

          9fad453b68ddb5ee3d36b751a9cee589c5a5de7337a1b008cedfcf75ca6f39d2b26251b99f52af028576b30081608385cf2343ca101374147b513555290e1c1b

        • memory/1920-0-0x00000000024C0000-0x00000000024C1000-memory.dmp

          Filesize

          4KB

        • memory/1920-35-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/2044-32-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/2044-8-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

          Filesize

          4KB

        • memory/4960-48-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-64-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-37-0x00000000025B0000-0x00000000025B1000-memory.dmp

          Filesize

          4KB

        • memory/4960-38-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-39-0x0000000010000000-0x000000001000B000-memory.dmp

          Filesize

          44KB

        • memory/4960-40-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-42-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-44-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-46-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-17-0x00000000025B0000-0x00000000025B1000-memory.dmp

          Filesize

          4KB

        • memory/4960-50-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-52-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-54-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-56-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-58-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-60-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-62-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-21-0x0000000010000000-0x000000001000B000-memory.dmp

          Filesize

          44KB

        • memory/4960-66-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-68-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-70-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-72-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-74-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-76-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-78-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-80-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-82-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-84-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-86-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-88-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-90-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-92-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-94-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-96-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB

        • memory/4960-98-0x0000000000400000-0x00000000005F8000-memory.dmp

          Filesize

          2.0MB