Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 00:01
Static task
static1
Behavioral task
behavioral1
Sample
20eb6b8655de71aad0ba6e71a045b1f6.exe
Resource
win7-20231129-en
General
-
Target
20eb6b8655de71aad0ba6e71a045b1f6.exe
-
Size
2.6MB
-
MD5
20eb6b8655de71aad0ba6e71a045b1f6
-
SHA1
1770246098ea07e2024dd31de0fba54916d7236b
-
SHA256
685933af075d310ddb454b399641cfdbf801441e5360df0e71204d63d2afc757
-
SHA512
bb6a8f071ca9d77ab6c10f90b3ba1ad1e86c7b326fa7731c13fde95554bba97cf374878a64a7ad4fec0aee3301751ab32d280a8c440aa78319fc89f5391f2259
-
SSDEEP
49152:pAI+mPQQSU9afXEDN50Qx8lMmD4gGovWhJLEx2BwDPw1V46hi5SC0DNdSM2SwMpt:pAI+M4UsuNxyvGoOnEx2BoQVlhi5S9OG
Malware Config
Extracted
ffdroider
http://186.2.171.3
Extracted
vidar
39.9
916
https://prophefliloc.tumblr.com/
-
profile_id
916
Signatures
-
FFDroider payload 2 IoCs
resource yara_rule behavioral2/memory/736-83-0x0000000000400000-0x000000000067D000-memory.dmp family_ffdroider behavioral2/memory/736-82-0x0000000000400000-0x000000000067D000-memory.dmp family_ffdroider -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 220 4320 rUNdlL32.eXe 26 -
Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/4596-124-0x0000000004930000-0x00000000049CD000-memory.dmp family_vidar behavioral2/memory/4596-125-0x0000000000400000-0x0000000002CBF000-memory.dmp family_vidar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 20eb6b8655de71aad0ba6e71a045b1f6.exe -
resource yara_rule behavioral2/memory/736-83-0x0000000000400000-0x000000000067D000-memory.dmp vmprotect behavioral2/memory/736-82-0x0000000000400000-0x000000000067D000-memory.dmp vmprotect -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe 20eb6b8655de71aad0ba6e71a045b1f6.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe 20eb6b8655de71aad0ba6e71a045b1f6.exe File created C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini 20eb6b8655de71aad0ba6e71a045b1f6.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe 20eb6b8655de71aad0ba6e71a045b1f6.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe 20eb6b8655de71aad0ba6e71a045b1f6.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe 20eb6b8655de71aad0ba6e71a045b1f6.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe 20eb6b8655de71aad0ba6e71a045b1f6.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe 20eb6b8655de71aad0ba6e71a045b1f6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 924 3860 WerFault.exe 4900 736 WerFault.exe 36 -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1416 wrote to memory of 2420 1416 20eb6b8655de71aad0ba6e71a045b1f6.exe 40 PID 1416 wrote to memory of 2420 1416 20eb6b8655de71aad0ba6e71a045b1f6.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\20eb6b8655de71aad0ba6e71a045b1f6.exe"C:\Users\Admin\AppData\Local\Temp\20eb6b8655de71aad0ba6e71a045b1f6.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"2⤵PID:4596
-
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"2⤵PID:4676
-
-
C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"2⤵PID:736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 19763⤵
- Program crash
PID:4900
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"2⤵PID:4340
-
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"2⤵PID:5044
-
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"2⤵PID:2420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3860 -ip 38601⤵PID:940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 6041⤵
- Program crash
PID:924
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵PID:3860
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:220
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a1⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\is-9O26K.tmp\GameBoxWin32.tmp"C:\Users\Admin\AppData\Local\Temp\is-9O26K.tmp\GameBoxWin32.tmp" /SL5="$70220,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"1⤵PID:4304
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:2456
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:2984
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:2688