Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2024, 03:49

General

  • Target

    c2617b76536e87cd4674ef8d27eaf75e.exe

  • Size

    17KB

  • MD5

    c2617b76536e87cd4674ef8d27eaf75e

  • SHA1

    d7eeb9060cbd6485ac5dbc93fe7264f839a826f7

  • SHA256

    563e813313dbf27a91c862046f293a6ab8bfa4120f372bc696c7a7bc79d8f948

  • SHA512

    cc24efd29adbf86b6ea04417f6b8065988405fd772541eba3545bd9f40f502fdd8f7ca4bd61ca1c399267417e85f07cf067b5fecc24dd1abc8a1da3a30b8eb4a

  • SSDEEP

    384:QipFh5F21r+bacSGomWFUWWnB6P8syRSuQam:QipwiezpFUWq22SuQ

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2617b76536e87cd4674ef8d27eaf75e.exe
    "C:\Users\Admin\AppData\Local\Temp\c2617b76536e87cd4674ef8d27eaf75e.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\F4A1.tmp.bat
      2⤵
        PID:5052

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\F4A1.tmp.bat

      Filesize

      179B

      MD5

      73015806b65ddd5e49d7b52b025b2501

      SHA1

      9051e65ee3bb8ba875a67a1c9c3536e2fec08c9c

      SHA256

      defab0de41134a7665a364f8ee55d6ec585f2cabe1149267bd4e48fcb6b9f033

      SHA512

      da2be1af525ea63aff99e624cff7ef2a2e1195f428ecc49cbcf19a1dbfb050126ac7b1fddb0cc5ce1b9d70fa4c28dca470cab835290f66801ae2e1e1e1646cc2

    • C:\Windows\SysWOW64\sfokhuqm.dll

      Filesize

      1.7MB

      MD5

      567940c2023fd41d5707c2c2ca6eec27

      SHA1

      c5d3091699fa5f15473e36774464b0d943e85c0a

      SHA256

      06c351b80a73379d465677c8f4e97320c9e96f99a703af4bd0458b832e45a380

      SHA512

      a3c34f5cf37160048a10394d001e47a68d6cd203b0cb5e32a85bb395ba944c211b99d56aa57ef9d227d3bf6e6a0bcb3773d4983c8d50a00521db2c2322cb7681

    • C:\Windows\SysWOW64\sfokhuqm.dll

      Filesize

      1.4MB

      MD5

      001138655e22e30837faa54bf95fcb43

      SHA1

      2b479131aac539a67cabf6054783e3779571311c

      SHA256

      2d3b91490b704194faab2ef8d4d5ff4bf50c522773f71808c4d1de0947873aec

      SHA512

      d0b2d2d493db629b2980f7bb3a36df43dc59df6ef9148b835d705942f62af28d130809a60b75fbe599ce9470396dbfe366d3f07e79dc218c06d3f471f049fe9f

    • memory/388-9-0x0000000010000000-0x0000000010008000-memory.dmp

      Filesize

      32KB

    • memory/388-14-0x0000000010000000-0x0000000010008000-memory.dmp

      Filesize

      32KB