Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
87b99ff1cc15db53fe36125c20729ecb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
87b99ff1cc15db53fe36125c20729ecb.exe
Resource
win10v2004-20231222-en
General
-
Target
87b99ff1cc15db53fe36125c20729ecb.exe
-
Size
62KB
-
MD5
87b99ff1cc15db53fe36125c20729ecb
-
SHA1
79a8af0126179cec876a1d13459a5f2f44c920b6
-
SHA256
73c6da25ccc05c26bca7428906bd03dc47677b6c183cd695d42e5602627918ad
-
SHA512
23a2f974d16c9f0fbf1029fccf1e2ff888b0b7fd05880503f2f179cbe075afb5ed9fe39c4d216cf6c59ef0a5da32199e0c3d1cde642d0715a54bf30e51a14954
-
SSDEEP
1536:iLbkc+dPeViOeZx/GtEqW+uPSLKulcx+H52:ivkc+dPeViNZS6lKL7M+H52
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\Autom\Parameters\ServiceDll = "%SystemRoot%\\System32\\fpurgh.dll" 87b99ff1cc15db53fe36125c20729ecb.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Autom\Parameters\ServiceDll = "%SystemRoot%\\System32\\fpurgh.dll" 87b99ff1cc15db53fe36125c20729ecb.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\Autom\Parameters\ServiceDll = "%SystemRoot%\\System32\\fpurgh.dll" 87b99ff1cc15db53fe36125c20729ecb.exe -
Deletes itself 1 IoCs
pid Process 548 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 1340 87b99ff1cc15db53fe36125c20729ecb.exe 548 svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\0004be5f.sys 87b99ff1cc15db53fe36125c20729ecb.exe File created C:\Windows\SysWOW64\fpurgh.dll 87b99ff1cc15db53fe36125c20729ecb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87b99ff1cc15db53fe36125c20729ecb.exe"C:\Users\Admin\AppData\Local\Temp\87b99ff1cc15db53fe36125c20729ecb.exe"1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:1340
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k Autom1⤵
- Deletes itself
- Loads dropped DLL
PID:548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD54ccd8f0d339c709cc5fd158f8024aab0
SHA173050491add825a4e12c2337ac77f85b9bdbcfbe
SHA256595ff2ffb35bab6c24ec6a78cc247da8ee14e6db1effc8d2fba6339ac08c5ff1
SHA512e1954f687446aeedbf7de435e38f39a754e2f39f73aed955eb3903f176219c5d0348f74136d505f8482bd4daaa5e3a85200fc13660d8a2fec891614ea7687bdf