Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/03/2024, 04:56
240317-fkpqlseg53 10Analysis
-
max time kernel
1200s -
max time network
1198s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
14/04/2024, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
cffa8abc1bd0d8409d62b1adb675a6d3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cffa8abc1bd0d8409d62b1adb675a6d3.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
cffa8abc1bd0d8409d62b1adb675a6d3.exe
Resource
win10v2004-20240412-en
General
-
Target
cffa8abc1bd0d8409d62b1adb675a6d3.exe
-
Size
434KB
-
MD5
cffa8abc1bd0d8409d62b1adb675a6d3
-
SHA1
37e8bc4d8ffc6ff4256a82bc057960e2cbb022e1
-
SHA256
ac8ec076126d9905b8a3e677c94607c356bd5418092ac00b25de85cad02f6380
-
SHA512
7112efdbc879550dd33ddf47f50d44e2ea4ab1e98d2d5d1c48a7f16dc949154228c933095e99050fea61970897c671195f9674bcdece090dc8a0a520e8bc9841
-
SSDEEP
12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnuk:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNbC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2668 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 6 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2668 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 73 PID 2520 wrote to memory of 2668 2520 cffa8abc1bd0d8409d62b1adb675a6d3.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\cffa8abc1bd0d8409d62b1adb675a6d3.exe"C:\Users\Admin\AppData\Local\Temp\cffa8abc1bd0d8409d62b1adb675a6d3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:2668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD5aa3c7d19c78d625bdeab0ed8e50ee32e
SHA1a492a0e48867abef8b16397560d32fc3726dcaf7
SHA25640d74284a1ccf348f726e1d148ae00c838ee67bcc5bd08d763f4523a20f75ac1
SHA512e8afd95f34f81b1cf72681b2d48e74256699d013c26e6fd64a3db2d79806f9e33a8e40ea27921a7a888eef03ec323dffe2ad1ff6f7ed7aaf19b67531775c22c4