Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 21:16

General

  • Target

    cmd_fw_installer_138430009_eb.exe

  • Size

    5.4MB

  • MD5

    b48216dca6f745a40645248384659fdd

  • SHA1

    3bc265e7282bfb5c63be6cc73a2b7aad9a060904

  • SHA256

    9b6394b0d1da147c5c718ebf3aba211ce2d4aefc63eb0dc80ed5cfc0db269bcd

  • SHA512

    488fbd2b606c4f829b0ec05217b7d9be687cb885b988bc7cdcf7e1d61da2ef06fc422646696e24c2a1c1a63d793bda2293204037bd5a0178a673c00e91b226ec

  • SSDEEP

    98304:n3oeoi7dSeyJ6A89FbeCD25kvriejkx9sZjMK6vx6IF/M8aWzBWcPNkNzt9e:n3oeoYSeyJ6vnKCD25kvmeh6vFF//aFU

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks for any installed AV software in registry 1 TTPs 36 IoCs
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cmd_fw_installer_138430009_eb.exe
    "C:\Users\Admin\AppData\Local\Temp\cmd_fw_installer_138430009_eb.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe" -log -setupname "cmd_fw_installer_138430009_eb.exe" -sfx "C:\Users\Admin\AppData\Local\Temp" -theme lycia -type web -mode cfwfree
      2⤵
      • Checks for any installed AV software in registry
      • Enumerates connected drives
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3628
      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall_138430009_eb.exe
        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall_138430009_eb.exe" -log -theme "lycia" -setupname "cmd_fw_installer_138430009_eb.exe" -type "web" -mode "cfwfree" -sfx "C:\Users\Admin\AppData\Local\Temp" -logfile "C:\Users\Admin\AppData\Local\Temp\\cmdinstall.exe_24-01-25_21.21.58.log" -parent 3628 "Admin" 1920
        3⤵
        • Checks for any installed AV software in registry
        • Enumerates connected drives
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Comodo Downloader\cis\download\installs\8050\installer_data\binaries\files_info.dat

    Filesize

    34KB

    MD5

    f42c56a1f750bdf43155a2aee0f1407c

    SHA1

    0929dd9594fccffe5e7e43ea33a5eb6467afab0b

    SHA256

    86e8a71d1327fe5f26901c8a7d10bac322dce1ff621e1339db9c7b6ab905244c

    SHA512

    31dc56d6455391a0075ab59d438335c9d38da43e1ef974bcdf14be059d63d48f8a8f7a1f6cd9eb5e790519a3824f59387abafef48417bbeb74e34b526646b8d9

  • C:\ProgramData\Comodo Downloader\cis\download\installs\8050\installer_data\eula\eula_cfwfree.html.tmp

    Filesize

    171KB

    MD5

    b655d81127550b07fbe2ac849e6e1e42

    SHA1

    61fa51e4c9f01d5c7302a8a9ac6c43bbc665c45d

    SHA256

    32ac5b1265a7cae273baab2be295ee71a9033ff4233bf92630872523770cc241

    SHA512

    4a8d05f7488e6bc91aa545618e1d6dedb7508bcf7d635777e2f67c82fcc40e29116924598ed563c7778c32e6a837a5f6467d8d4c01ae282a84b89783fbde9571

  • C:\ProgramData\Comodo Downloader\cis\download\installs\installer_data\installer_init.xml

    Filesize

    20KB

    MD5

    06c0057d77fc4789b1428dd6710cd5ab

    SHA1

    660445d67f92e84ee9aa96a7aa6cd50ba43148ca

    SHA256

    e3a998c06b37cec5570409e0714af72a1a936759b4420adf1b0dfaf43bb7218e

    SHA512

    497a86bd35149465ef3ce3d7b483a3d4950475963a9cc20075f4f92a54b05fbffa97b537b256c9bcc31a3a20f4229d33ceed45f6bd30fc9057cf879bbb368a91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007

    Filesize

    766B

    MD5

    afd26b4d172c5cae18a4dd49630e49cc

    SHA1

    8a2e513ed2bbc0d265ae756fd88a9a0e98494426

    SHA256

    7f9dcf4870c902aaa62982f66c42e2e0bf63348f2dd29bd5ed9619e6bf5118fe

    SHA512

    468ffc632bdd7c6249e9f9b08791bdd190a38c7ecf91d3c200334582841bf2037a522504b13e6fe097941989a9c105e024bc70012afaa6b4d3808cba98046da5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3

    Filesize

    509B

    MD5

    d5b5cd332ae3f960a05ef1a58984e1b4

    SHA1

    4385216a63b8a206fd762f903b06b3249c44f398

    SHA256

    96834690ead75d4f8c0ec22894abc257c5d2d0d3a2ffec250f88896530be89fc

    SHA512

    e9de5619e95dde747232cb7cf08a3d0b9c41960faa89acf201d132de071d45d4df165095eb5814208eff1d9797bbba57fcb705198892ceb7e77f606b7717747c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F26A2159BA21EA573A1C5E3DE2CF211_7541962669C96CEAB06421EC12621007

    Filesize

    484B

    MD5

    025cc920c5e01c685536b0ffa016acc1

    SHA1

    be2c6d3ccbf91a2cd368308be2dcecaa5e23dfa2

    SHA256

    9162408e165f9fce44e31bb926f213b67369075602db9247a8f4371010458a3a

    SHA512

    523c3352d6e35f2f85ed94a80c11361f7496e139caf9a68610168e245c94500fe0b7e4657e547a542fb0c3abbc2cea9fda98c9317370197095ac87284b704ed5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D11549FC90445E1CE90F96A21958A17_941A5BE5FAF3230B9FC294754AF2A1C3

    Filesize

    490B

    MD5

    c375a17388ed86f33064f516fa503622

    SHA1

    f6d0a44379581bd6dc07d7a3b0cf56326b94dffd

    SHA256

    af65ab78fe8abbec4df02e0337adfe2355b8518c54c13b8a538f68ab765b7e4e

    SHA512

    1c488c93c6962978c7901d60fd9988710b6a41de1315d3266ebd530a6c8d564d534f6bbdf90defb5db57eeedaa2afadf08fe6c458ddc25aebc205354b1095a2c

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.dll

    Filesize

    277KB

    MD5

    7baac18fb157c76574ca3d7a2f5eb193

    SHA1

    6460577ce621fa28133096073376f6a88f8acd61

    SHA256

    347144ae998d96c6b8664abf56f3ff8cfa4dcdfd6e13205d7e8ee2f3b77eefc2

    SHA512

    513cc213da81db470f8675c29162f4b724bb92a690edd451025eb68588971eebb937f88cc5a659222f2bbbd99440aa56800bf4167bb8912ea87a0b2648b002ea

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdhtml.dll

    Filesize

    4.2MB

    MD5

    6d9aa26bb18af69dc74ae8e822eb53dd

    SHA1

    6ef20da9b9e70afa742f047f1c6f9d3e58290450

    SHA256

    cf140523b8834de1c37efa29b02adcdc88babc0f8ee90ba93dd98c260d7036c3

    SHA512

    3a9e8f15d207e98bb182f8d1838e93dba9750e6cfc79b72aab0706f969866447e50b3ab28bc1768a7cac7e7733cde80085cabcefefae0d287f08374578935c36

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdhtml.dll

    Filesize

    860KB

    MD5

    b4accebb2c3159b000f166236f9ef466

    SHA1

    0c8b43c310e9a4607c82264c5a51dbfd91088942

    SHA256

    26078b67ce3b79466e87c13f294b16c69b279afe370c43a0fe92d67aec298006

    SHA512

    8b0aa6f1c8e012ed2da399f948030770eaeca75d33976b598f6f1e3a0bf54239f6a21c9b86014e39b1490ad739cc496b43b51de2ab4e2e04f76a8e99fa278c9c

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe

    Filesize

    1.8MB

    MD5

    45927854e82c6a4063743a00b6e8d6db

    SHA1

    7cc517f8d310a3616cc66d30a0fb3e3db192ee9d

    SHA256

    0ef0ab4f561322e697eef0745e36a10f35b1de731a008d2674d223d5a70489c0

    SHA512

    a18262fa34cda7e83eb7771a26ccbf13e6c6073973d6aa99fd4876596d6f041c24a4691ae2db85a8e14dd2d04c448fc0edc96be6c8135e02bdaf424c776ff220

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe

    Filesize

    930KB

    MD5

    4e0f71115e5aa8f1b3e651d6a4a36693

    SHA1

    deb9ef7560b972428e2cf3587591e343957e3c32

    SHA256

    5500c93bb00e20e5535bd6f89ad0df88bf70e3fcd9c0e8627ff2fb66fc6772ab

    SHA512

    901fc16fe0b676953cec45f446f6598ce8d06d69d760c5934b29ae8f5a44d287aab9a755ec3e027543997d4e8bf0c685b0b8dd188cfc7ae27404a4f19ee1525b

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall.exe

    Filesize

    537KB

    MD5

    10f0367657b74e6d3f8bd95975193bea

    SHA1

    effcebeb29aeedabfb9192fcd46c4d0f24a98c2e

    SHA256

    a2085480dc5d6d48c7e427f3a69cfe3e88746915307d7998bc18af0e2b231b37

    SHA512

    440f3c5c1e866d28d2cde56ad70fe23f065cb04e85ba1b896fc978c2d2c336477e596a343169e436278c1678692e121af0426f01915f77a4b111041aa7404536

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdinstall_138430009_eb.exe

    Filesize

    503KB

    MD5

    ca00c602bf3cf667ccb2e10d7a6eb38a

    SHA1

    7082e5fd8dccda3dbeb2faf2de59eb181e1bf064

    SHA256

    2bec6bf874459e43177e980d3e25d2023d26945ae4ba15789e9f66c3c161f6b1

    SHA512

    14fafb5b1beca7c78f32d9775aa312ac1dbc023462fd2866ad86052c91667906f40acae991cea0e83bdde78aac160c9c9cfd4bf9d7ea0bf9a5eea32fb8f7ab30

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdres.dll

    Filesize

    367KB

    MD5

    a4b3e07a9d407bca7a0ed76ea7c4945f

    SHA1

    af16d87110e2f9e64d5c35a6d522151b69377bbc

    SHA256

    b115a17e7500dbc34cce1f8e84a59f072a26ad49be5dcde6ac5908e4d2ad3555

    SHA512

    77c6ba298f5bd4c04192660d365d2a45ecb23fa441818735bd01050677037e1976670dcb457b6684343fbccb02a6fcfd98f22ae9f2de263057157917ee28d981

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer_langdata.bin

    Filesize

    5KB

    MD5

    b80eda6258e28b537651f8e5ebd997ff

    SHA1

    826741e138e8342f4bc3303838e347a44bb93546

    SHA256

    6e960dfed451c2dfb99352d25d3df8dd46fe7d80c9af79805c0cfbd1a99a2709

    SHA512

    9fce1cb5fe8b6a2bc4d13c1ca3ec31c926c6dd33717f145da6952ae33144eb11a6ee9e751e1d3e2d5d6ce7768e9f9602773a917d9f5f8473670e6d631b932b74

  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\themes\ilycia.set

    Filesize

    459KB

    MD5

    ba03e9cc380278ea2fad1d64267ad93c

    SHA1

    5dc5f3938df3fee7d9baa4eda9d7641d90be9748

    SHA256

    f3c6e2e44e10dc0ba5dc3fabe7ba47756a330293e096186591db844d58fd09cd

    SHA512

    26b8a36a40b780281631418100361095beba166203b3bf5d0915a7c647fbc04b853e4e206071c9ebf8edd34f8f39eb917767376042bf81ee7306841a7b130575

  • C:\Users\Admin\AppData\Local\Temp\cmdinstall.exe_24-01-25_21.21.58.log

    Filesize

    6KB

    MD5

    819e6002d573270ae068ebb518923b7d

    SHA1

    8cca40e27d8e7084fd480d70cce21e5bfbda7ae2

    SHA256

    3ce84fdf25be81fb63b16a7329197257ea1cc029fedd3376122a1888e4698f0f

    SHA512

    7df5e8d2e3881066080c4cc0a4287ca52eec58256b8fec9719d22d26fa2e06e1be1f743b8584e7a8d7d6fab17d974f3aa3727f4cabeda10d532a0b507ab0e064