Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2024, 02:14

General

  • Target

    87b99ff1cc15db53fe36125c20729ecb.exe

  • Size

    62KB

  • MD5

    87b99ff1cc15db53fe36125c20729ecb

  • SHA1

    79a8af0126179cec876a1d13459a5f2f44c920b6

  • SHA256

    73c6da25ccc05c26bca7428906bd03dc47677b6c183cd695d42e5602627918ad

  • SHA512

    23a2f974d16c9f0fbf1029fccf1e2ff888b0b7fd05880503f2f179cbe075afb5ed9fe39c4d216cf6c59ef0a5da32199e0c3d1cde642d0715a54bf30e51a14954

  • SSDEEP

    1536:iLbkc+dPeViOeZx/GtEqW+uPSLKulcx+H52:ivkc+dPeViNZS6lKL7M+H52

Score
8/10

Malware Config

Signatures

  • Sets DLL path for service in the registry 2 TTPs 3 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87b99ff1cc15db53fe36125c20729ecb.exe
    "C:\Users\Admin\AppData\Local\Temp\87b99ff1cc15db53fe36125c20729ecb.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Loads dropped DLL
    • Drops file in System32 directory
    PID:1340
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k Autom
    1⤵
    • Deletes itself
    • Loads dropped DLL
    PID:548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\fpurgh.dll

    Filesize

    87KB

    MD5

    4ccd8f0d339c709cc5fd158f8024aab0

    SHA1

    73050491add825a4e12c2337ac77f85b9bdbcfbe

    SHA256

    595ff2ffb35bab6c24ec6a78cc247da8ee14e6db1effc8d2fba6339ac08c5ff1

    SHA512

    e1954f687446aeedbf7de435e38f39a754e2f39f73aed955eb3903f176219c5d0348f74136d505f8482bd4daaa5e3a85200fc13660d8a2fec891614ea7687bdf