Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2023, 07:51 UTC

General

  • Target

    6a4e24f770b29f86d414c96e1475ba6f942435400edcece02768bf7ac006f381.exe

  • Size

    5.2MB

  • MD5

    649eb79d17d97ca9052c711dafd2e1ce

  • SHA1

    f503c05d95729a2bbd968aad654bc957dea508da

  • SHA256

    6a4e24f770b29f86d414c96e1475ba6f942435400edcece02768bf7ac006f381

  • SHA512

    c93ee616481f157002ac8d7335b201012b38e90b52414cfd59ad9cfa44e2fc8140a5f462b2f436e94c95d442dafa1a0b24dbf8681c0fac6b718292d196a75e4d

  • SSDEEP

    98304:2chHMKyDyc70SwAvO01JgBixtqMhlE4f+Ue/czLiRZvcFqhblsXlwagEblE:xy3l80DBl5f+2QvQus1zgCu

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a4e24f770b29f86d414c96e1475ba6f942435400edcece02768bf7ac006f381.exe
    "C:\Users\Admin\AppData\Local\Temp\6a4e24f770b29f86d414c96e1475ba6f942435400edcece02768bf7ac006f381.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\Users\Admin\AppData\Local\Temp\is-K0MPK.tmp\6a4e24f770b29f86d414c96e1475ba6f942435400edcece02768bf7ac006f381.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-K0MPK.tmp\6a4e24f770b29f86d414c96e1475ba6f942435400edcece02768bf7ac006f381.tmp" /SL5="$8022A,5168582,54272,C:\Users\Admin\AppData\Local\Temp\6a4e24f770b29f86d414c96e1475ba6f942435400edcece02768bf7ac006f381.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:4300
        • C:\Program Files (x86)\Common Files\CrossTV\CrossTV.exe
          "C:\Program Files (x86)\Common Files\CrossTV\CrossTV.exe" -i
          3⤵
          • Executes dropped EXE
          PID:1240
        • C:\Program Files (x86)\Common Files\CrossTV\CrossTV.exe
          "C:\Program Files (x86)\Common Files\CrossTV\CrossTV.exe" -s
          3⤵
          • Executes dropped EXE
          PID:2392
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 24
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4928
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 24
            4⤵
              PID:492

      Network

      • flag-us
        DNS
        2.136.104.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        2.136.104.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        138.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        138.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        158.240.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        158.240.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        121.175.53.84.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        121.175.53.84.in-addr.arpa
        IN PTR
        Response
        121.175.53.84.in-addr.arpa
        IN PTR
        a84-53-175-121deploystaticakamaitechnologiescom
      • flag-us
        DNS
        126.21.238.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        126.21.238.8.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        22.236.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.236.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-bg
        DNS
        aauetzp.ru
        CrossTV.exe
        Remote address:
        88.80.147.105:53
        Request
        aauetzp.ru
        IN A
        Response
        aauetzp.ru
        IN A
        185.141.63.253
      • flag-us
        DNS
        105.147.80.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        105.147.80.88.in-addr.arpa
        IN PTR
        Response
      • flag-bg
        GET
        http://aauetzp.ru/fox.php?c=de7ef49b2c006853fb383b753552f54761ad1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439d40c87a0c922e9d59869d35226842b4757736ce967179ccd0d6345d528fd307fb12c7db
        CrossTV.exe
        Remote address:
        185.141.63.253:80
        Request
        GET /fox.php?c=de7ef49b2c006853fb383b753552f54761ad1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439d40c87a0c922e9d59869d35226842b4757736ce967179ccd0d6345d528fd307fb12c7db HTTP/1.1
        Host: aauetzp.ru
        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Fri, 24 Nov 2023 07:54:15 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        Vary: Accept-Encoding
      • flag-us
        DNS
        253.63.141.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        253.63.141.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.173.189.20.in-addr.arpa
        IN PTR
        Response
      • 185.141.63.253:80
        http://aauetzp.ru/fox.php?c=de7ef49b2c006853fb383b753552f54761ad1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439d40c87a0c922e9d59869d35226842b4757736ce967179ccd0d6345d528fd307fb12c7db
        http
        CrossTV.exe
        475 B
        374 B
        4
        4

        HTTP Request

        GET http://aauetzp.ru/fox.php?c=de7ef49b2c006853fb383b753552f54761ad1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439d40c87a0c922e9d59869d35226842b4757736ce967179ccd0d6345d528fd307fb12c7db

        HTTP Response

        200
      • 8.8.8.8:53
        2.136.104.51.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        2.136.104.51.in-addr.arpa

      • 8.8.8.8:53
        138.32.126.40.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        138.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        158.240.127.40.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        158.240.127.40.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        206.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        121.175.53.84.in-addr.arpa
        dns
        72 B
        137 B
        1
        1

        DNS Request

        121.175.53.84.in-addr.arpa

      • 8.8.8.8:53
        126.21.238.8.in-addr.arpa
        dns
        71 B
        125 B
        1
        1

        DNS Request

        126.21.238.8.in-addr.arpa

      • 8.8.8.8:53
        22.236.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        22.236.111.52.in-addr.arpa

      • 88.80.147.105:53
        aauetzp.ru
        dns
        CrossTV.exe
        56 B
        82 B
        1
        1

        DNS Request

        aauetzp.ru

        DNS Response

        185.141.63.253

      • 8.8.8.8:53
        105.147.80.88.in-addr.arpa
        dns
        72 B
        123 B
        1
        1

        DNS Request

        105.147.80.88.in-addr.arpa

      • 8.8.8.8:53
        253.63.141.185.in-addr.arpa
        dns
        73 B
        124 B
        1
        1

        DNS Request

        253.63.141.185.in-addr.arpa

      • 8.8.8.8:53
        18.173.189.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        18.173.189.20.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Common Files\CrossTV\CrossTV.exe

        Filesize

        4.4MB

        MD5

        fc4f4c9f8f9f4401ead279be1f4de6b5

        SHA1

        e58284242178fef00db71262eb1d5afee6b13d57

        SHA256

        100716c3ec3c63ab459854adb3925e894770a8d23c209fd515c5045905fec04d

        SHA512

        085898d0b5d6637fbea4c0ea0be29c70fe9588960219de5845f324ce1f272fbe5a6c22e07677e602f3c90a44fcad0381b557159aa3e7126ae2ababbfafb6970c

      • C:\Program Files (x86)\Common Files\CrossTV\CrossTV.exe

        Filesize

        4.4MB

        MD5

        fc4f4c9f8f9f4401ead279be1f4de6b5

        SHA1

        e58284242178fef00db71262eb1d5afee6b13d57

        SHA256

        100716c3ec3c63ab459854adb3925e894770a8d23c209fd515c5045905fec04d

        SHA512

        085898d0b5d6637fbea4c0ea0be29c70fe9588960219de5845f324ce1f272fbe5a6c22e07677e602f3c90a44fcad0381b557159aa3e7126ae2ababbfafb6970c

      • C:\Program Files (x86)\Common Files\CrossTV\CrossTV.exe

        Filesize

        4.4MB

        MD5

        fc4f4c9f8f9f4401ead279be1f4de6b5

        SHA1

        e58284242178fef00db71262eb1d5afee6b13d57

        SHA256

        100716c3ec3c63ab459854adb3925e894770a8d23c209fd515c5045905fec04d

        SHA512

        085898d0b5d6637fbea4c0ea0be29c70fe9588960219de5845f324ce1f272fbe5a6c22e07677e602f3c90a44fcad0381b557159aa3e7126ae2ababbfafb6970c

      • C:\Users\Admin\AppData\Local\Temp\is-K0MPK.tmp\6a4e24f770b29f86d414c96e1475ba6f942435400edcece02768bf7ac006f381.tmp

        Filesize

        683KB

        MD5

        f507ce43ea08d1721816ad4b0e090f50

        SHA1

        e4f02bcd410bddabea4c741838d9a88386547629

        SHA256

        d2218bde27d66f28e3caf15e899653a9357ebdc7adf9a763b687f6c03c93e5e1

        SHA512

        37b2f92df632f75447572df840a236ef01021e8291536bf2e8156179333f770afdd8bcbf50cb05bbdbdaa53c00ace46119290800b115823ea035a2389a3f6693

      • C:\Users\Admin\AppData\Local\Temp\is-K0MPK.tmp\6a4e24f770b29f86d414c96e1475ba6f942435400edcece02768bf7ac006f381.tmp

        Filesize

        683KB

        MD5

        f507ce43ea08d1721816ad4b0e090f50

        SHA1

        e4f02bcd410bddabea4c741838d9a88386547629

        SHA256

        d2218bde27d66f28e3caf15e899653a9357ebdc7adf9a763b687f6c03c93e5e1

        SHA512

        37b2f92df632f75447572df840a236ef01021e8291536bf2e8156179333f770afdd8bcbf50cb05bbdbdaa53c00ace46119290800b115823ea035a2389a3f6693

      • C:\Users\Admin\AppData\Local\Temp\is-NRPAR.tmp\_isetup\_iscrypt.dll

        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      • C:\Users\Admin\AppData\Local\Temp\is-NRPAR.tmp\_isetup\_isdecmp.dll

        Filesize

        13KB

        MD5

        a813d18268affd4763dde940246dc7e5

        SHA1

        c7366e1fd925c17cc6068001bd38eaef5b42852f

        SHA256

        e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

        SHA512

        b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

      • C:\Users\Admin\AppData\Local\Temp\is-NRPAR.tmp\_isetup\_isdecmp.dll

        Filesize

        13KB

        MD5

        a813d18268affd4763dde940246dc7e5

        SHA1

        c7366e1fd925c17cc6068001bd38eaef5b42852f

        SHA256

        e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

        SHA512

        b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

      • memory/1240-65-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/1240-60-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/1240-61-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-72-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-100-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-120-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-68-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-69-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-117-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-113-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-110-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-107-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-76-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-77-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-79-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-81-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-84-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-87-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-90-0x00000000009E0000-0x0000000000A8D000-memory.dmp

        Filesize

        692KB

      • memory/2392-91-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-92-0x00000000009E0000-0x0000000000A8D000-memory.dmp

        Filesize

        692KB

      • memory/2392-97-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-104-0x0000000000400000-0x0000000000871000-memory.dmp

        Filesize

        4.4MB

      • memory/2392-102-0x00000000009E0000-0x0000000000A8D000-memory.dmp

        Filesize

        692KB

      • memory/3308-0-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3308-70-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/3308-2-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/5096-7-0x0000000000680000-0x0000000000681000-memory.dmp

        Filesize

        4KB

      • memory/5096-74-0x0000000000680000-0x0000000000681000-memory.dmp

        Filesize

        4KB

      • memory/5096-71-0x0000000000400000-0x00000000004BA000-memory.dmp

        Filesize

        744KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.