Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 01:08

General

  • Target

    1f4f390b42a7f516013d7db571b32115.exe

  • Size

    724KB

  • MD5

    1f4f390b42a7f516013d7db571b32115

  • SHA1

    8dddb9ff68c0d1dbc62a782cae2d64c4eb18091c

  • SHA256

    6bd83bf1f9e735a3c7951f8f55f22cf31156063ad56bf80f94238fd02faf4ffc

  • SHA512

    d517552bea5b825de25de86d6332a28480078294c62761ea576c3648792dcdc806d984a375c3275e38820bc6ad61a7fdf0e6712fd0c0168af8d2ef9ad42432d0

  • SSDEEP

    12288:Fkfc1hZjmvZQy58/fviZ8rJSgmP21uJ0m5FvRx58bCjFVBPnBhTp/KZ:d1zjmvG3i2la15TgwRBvS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f4f390b42a7f516013d7db571b32115.exe
    "C:\Users\Admin\AppData\Local\Temp\1f4f390b42a7f516013d7db571b32115.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:516
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bifrost.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Bifrost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2264
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SERVER~1.EXE
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1572
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3492

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1572-8-0x0000000010000000-0x0000000010011000-memory.dmp

      Filesize

      68KB

    • memory/1572-6-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1572-18-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1572-16-0x0000000010000000-0x0000000010011000-memory.dmp

      Filesize

      68KB

    • memory/2264-22-0x0000000000400000-0x00000000005C0000-memory.dmp

      Filesize

      1.8MB

    • memory/2264-23-0x0000000000400000-0x00000000005C0000-memory.dmp

      Filesize

      1.8MB

    • memory/2264-24-0x0000000000400000-0x00000000005C0000-memory.dmp

      Filesize

      1.8MB

    • memory/3492-10-0x000000007FFF0000-0x000000007FFF1000-memory.dmp

      Filesize

      4KB

    • memory/3492-12-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

      Filesize

      24KB