Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/01/2024, 19:30

General

  • Target

    41b8b989db23687968e4ca8b2561a073.exe

  • Size

    156KB

  • MD5

    41b8b989db23687968e4ca8b2561a073

  • SHA1

    9111a7eccd4b95d0f2a4b5d7996332bc3471ebc2

  • SHA256

    3ef2f553a247061af8ff7ed5e6777d0a24fbff57c4bfad318fb3c611809205a5

  • SHA512

    2beee1011573a8355fe893f0732961736cb78f115402226c4c8c866ecfb37a8b9c133ab2fc91fcd2d923327409371cde236d44f301d9322e3d0bae794ac1a080

  • SSDEEP

    3072:MBd1HE2MtU7Qv0w4ZRRQMMDwtIMCeFP4AN3EE5j4oQ:OdhE2R7Qvb4tQTaCeFP4A7d

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41b8b989db23687968e4ca8b2561a073.exe
    "C:\Users\Admin\AppData\Local\Temp\41b8b989db23687968e4ca8b2561a073.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4896
    • C:\Users\Admin\fuiawa.exe
      "C:\Users\Admin\fuiawa.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\fuiawa.exe

    Filesize

    156KB

    MD5

    934fad256f822e1f18f69877a9052f0b

    SHA1

    7d86b4143ae88dfe3a082736104e7593032f6fdc

    SHA256

    6a8cea9e6a27ef9d2fa3dcf71d164cef46edf3a9bd7b614689f1c6891da8b315

    SHA512

    e38605996ed44219a48fd3a1f3a66069bd8cb17b6cb0d720b42224989f4c423d204a219a11163845eb87aca872bf5708f02a7ffca938067dfc3f3defcd903093