Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27/03/2024, 19:49 UTC

General

  • Target

    4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307.exe

  • Size

    176KB

  • MD5

    31e98044fdb24061066562686cd7a8f8

  • SHA1

    fe00db41639a0cf35ee10970c2c494b4a501119e

  • SHA256

    4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307

  • SHA512

    d3164406fab832bd34da5dc53368bcfef70feada20adb046e2921b489f7014290748b1182a15ecc006019d77a9a0adf19f9f78e90b8b795c2bbdf5ef7267eb09

  • SSDEEP

    3072:OyMO2Lb/urHZ3faZ5De/Ey032yaCMMq9FIUPv9XOVw1FaX6lwzmOJfYerMMq9FIT:Oy4HKvaZ5q/E4f9FIUpOVw86CmOJfToG

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 8 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Drops file in System32 directory 12 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307.exe
    "C:\Users\Admin\AppData\Local\Temp\4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Windows\SysWOW64\Ecqqpgli.exe
      C:\Windows\system32\Ecqqpgli.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Windows\SysWOW64\Ecejkf32.exe
        C:\Windows\system32\Ecejkf32.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Windows\SysWOW64\Echfaf32.exe
          C:\Windows\system32\Echfaf32.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2564
          • C:\Windows\SysWOW64\Fkckeh32.exe
            C:\Windows\system32\Fkckeh32.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2524
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 140
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\Fkckeh32.exe

    Filesize

    176KB

    MD5

    f5465494db345d3e4e416e4d6f037700

    SHA1

    912557b094343be87c2fe5edb3d4bbfc024512d3

    SHA256

    85db5f9a9b87a1d8949b20c2e1637b5dbe1bf2e285134309995eeab982f6b72f

    SHA512

    a69aebc1c9d043e9b806f358e6a8c71484fecab1f119f9e38fd233b1ce73ded2e80d1512602005d433ddc9b6ac351fc6e2f6e80c83987fc0e5a38dd35102ab68

  • \Windows\SysWOW64\Ecejkf32.exe

    Filesize

    176KB

    MD5

    81d80b02cdb13bb7fda58fe9accb431e

    SHA1

    5f2e1ff1261b2baa77cdcf5e100a01b8afff0335

    SHA256

    e280b513f82a2a71dc0328d4cc4e1fdc4bfd268032389a76f4d00f95246b6c62

    SHA512

    d11e52cc21b05ca3bb1f0d384bd14e1ed67fc19f32eb772e714cd51361bbe9d60d0b93ef91397220092e10ea0c8c18389bb361696d53e4852748d8c5f919b056

  • \Windows\SysWOW64\Echfaf32.exe

    Filesize

    176KB

    MD5

    2d0d4a29688c70dca8e8c8e7ffc99366

    SHA1

    e275dfbba340103b20706422d6fb87d4a9f59e6b

    SHA256

    1fc4f4accfa1cb7959796cae5da0acdca2ee6a5d344f5019d61afe7cfeae773e

    SHA512

    14447e0b4c595fc31781938356882d21aacb65f0bb81d1db4cfe4543089ecc896ee41bbccf02564c7e298cba1886a01988d0f9181417595938f477206820e8cb

  • \Windows\SysWOW64\Ecqqpgli.exe

    Filesize

    176KB

    MD5

    0c70cd7760ecd487cc3fad5d4a15205c

    SHA1

    a96f2b4c333d682c36433ef1b6e81d5c528b8363

    SHA256

    9fe40e7c68f2e173e8ba06ac6ab579aa6b8a59e982e2e64f02da4bed3576b15b

    SHA512

    d8ed500a96bae77c190720221a8101042a598de311a3365a6b9774ae3f311345dc9a33fbd37a25946a821cdf52a4cf7a4757827622c12935ae46eb5c772c8288

  • memory/1220-6-0x0000000000220000-0x0000000000259000-memory.dmp

    Filesize

    228KB

  • memory/1220-60-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/1220-0-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/1916-38-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/1916-52-0x00000000003B0000-0x00000000003E9000-memory.dmp

    Filesize

    228KB

  • memory/2204-26-0x0000000000270000-0x00000000002A9000-memory.dmp

    Filesize

    228KB

  • memory/2204-20-0x0000000000270000-0x00000000002A9000-memory.dmp

    Filesize

    228KB

  • memory/2204-61-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2524-54-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2564-53-0x0000000000220000-0x0000000000259000-memory.dmp

    Filesize

    228KB

  • memory/2564-55-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.