Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    150s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/03/2024, 21:54

General

  • Target

    FP_AX_CAB_INSTALLER64.exe

  • Size

    757KB

  • MD5

    c7a36096c3c7fe45a70fe9375cabfbd7

  • SHA1

    a8ce9a12c963874a28cf067eb4f187d63e82f356

  • SHA256

    b1124fb749b2e46e6d5e572b28f847f20c3432dc693c41c765b569e17485d95b

  • SHA512

    06c9eadeddcdd5c4274b430336c96d39ee3df2fa6814272cbf937e24a8f07661bad276de9486fb5570202855b97e7a1fa266d4f36885457215f581fada88000b

  • SSDEEP

    12288:FZi53OdV+TLBLD5bHoIP4+9B7OzbgxyT08CAAAAAAAAAAAAAAAXAbAAAAAAAAAA6:FZ23Odc1R94zbvT0bW

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FP_AX_CAB_INSTALLER64.exe
    "C:\Users\Admin\AppData\Local\Temp\FP_AX_CAB_INSTALLER64.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3308
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://www.adobe.com/software/flash/about/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:208 CREDAT:82945 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    3752459352c1f1cb603d0cb700cccec3

    SHA1

    003f35792d54be17d517a4af7c3dbef49a23bddf

    SHA256

    9bd9b22ad8b16128aa257e9629ec146612d2c14ccd422248a5cd60128c0fb534

    SHA512

    ceceac9e5e353507b28d3755cf1c372a669d793287c05b6c6dc0d4465289b9846399d16b396ddaffdf699b1cc474566648e5239c20288fca3b3d9c7d620283f7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    9a172db557347493646f29ed4ddb595c

    SHA1

    d2a782809c1bb0465ad592c4c1eac7822d0a4351

    SHA256

    a0a7c755b63bd80b9c0c1605800b5c66aaf028565965dbf7277eeabba5b5fecb

    SHA512

    b5b14190a4c7acae54c7e653a384090a09a7c395c2e99d7a017640529301ebc75f3fa74886f71d237b470aac3fd5728155adc8d737b39da456c95ff5f1555711

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verF6F3.tmp

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9GGQ35I\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\BM4POMJE.cookie

    Filesize

    545B

    MD5

    7d6e15876890e0cf7b020029b230e9df

    SHA1

    1f7b628d007bd8c0535797138c35eca1a7214264

    SHA256

    8823b8842c53c2a5c06b92201d56ab31157eabefa7cc890e35a736cebc23868f

    SHA512

    be3638c229aa85b4c2df0c3afd0413d3b8675ee191e760f9ad8f1dba2127dd923f57d46cba1184583fe8fc536cb9bad6c4a9e8e09aecdcb5967dc2a1349c7e1d