Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/03/2024, 04:56
240317-fkpqlseg53 10Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/04/2024, 14:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cffa8abc1bd0d8409d62b1adb675a6d3.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cffa8abc1bd0d8409d62b1adb675a6d3.exe
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
cffa8abc1bd0d8409d62b1adb675a6d3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
cffa8abc1bd0d8409d62b1adb675a6d3.exe
-
Size
434KB
-
MD5
cffa8abc1bd0d8409d62b1adb675a6d3
-
SHA1
37e8bc4d8ffc6ff4256a82bc057960e2cbb022e1
-
SHA256
ac8ec076126d9905b8a3e677c94607c356bd5418092ac00b25de85cad02f6380
-
SHA512
7112efdbc879550dd33ddf47f50d44e2ea4ab1e98d2d5d1c48a7f16dc949154228c933095e99050fea61970897c671195f9674bcdece090dc8a0a520e8bc9841
-
SSDEEP
12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnuk:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNbC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4340 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 52 api.ipify.org 53 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 4340 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 90 PID 412 wrote to memory of 4340 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 90 PID 412 wrote to memory of 4568 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 77 PID 412 wrote to memory of 4848 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 78 PID 412 wrote to memory of 3340 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 79 PID 412 wrote to memory of 3996 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 80 PID 412 wrote to memory of 4744 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 81 PID 412 wrote to memory of 2924 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 83 PID 412 wrote to memory of 3624 412 cffa8abc1bd0d8409d62b1adb675a6d3.exe 84 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99 PID 4568 wrote to memory of 3104 4568 msedge.exe 99
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffc479f2e98,0x7ffc479f2ea4,0x7ffc479f2eb02⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2248 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:22⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3316 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:32⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3324 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:82⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5404 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:12⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5508 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:12⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3680 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:82⤵PID:3104
-
-
C:\Users\Admin\AppData\Local\Temp\cffa8abc1bd0d8409d62b1adb675a6d3.exe"C:\Users\Admin\AppData\Local\Temp\cffa8abc1bd0d8409d62b1adb675a6d3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:4340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD5ea5ae38ea1840c98d85cfc21672f82eb
SHA16f0a523ca623d87289f9c3e411710fd1fb2a98b1
SHA256cfddf64b1f58920041f3d16b5f45a461b2053656c55a01dda5c6c4df2ec12177
SHA5128b029480bf090fa4229a663037d5509cae4c7fb87f83ee2d1c0f881fab231074cc3fb08ac6f73d9a39c4c03bfe4dbbe5d575faaccf377f0be3d3a1e6e07bac2b