Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/03/2024, 04:56
240317-fkpqlseg53 10Analysis
-
max time kernel
1200s -
max time network
1168s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
14/04/2024, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
cffa8abc1bd0d8409d62b1adb675a6d3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cffa8abc1bd0d8409d62b1adb675a6d3.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
cffa8abc1bd0d8409d62b1adb675a6d3.exe
Resource
win10v2004-20240412-en
General
-
Target
cffa8abc1bd0d8409d62b1adb675a6d3.exe
-
Size
434KB
-
MD5
cffa8abc1bd0d8409d62b1adb675a6d3
-
SHA1
37e8bc4d8ffc6ff4256a82bc057960e2cbb022e1
-
SHA256
ac8ec076126d9905b8a3e677c94607c356bd5418092ac00b25de85cad02f6380
-
SHA512
7112efdbc879550dd33ddf47f50d44e2ea4ab1e98d2d5d1c48a7f16dc949154228c933095e99050fea61970897c671195f9674bcdece090dc8a0a520e8bc9841
-
SSDEEP
12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnuk:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNbC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2292 GetX64BTIT.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 26 api.ipify.org 27 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1324 wrote to memory of 2292 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 87 PID 1324 wrote to memory of 2292 1324 cffa8abc1bd0d8409d62b1adb675a6d3.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\cffa8abc1bd0d8409d62b1adb675a6d3.exe"C:\Users\Admin\AppData\Local\Temp\cffa8abc1bd0d8409d62b1adb675a6d3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"2⤵
- Executes dropped EXE
PID:2292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD5c3b56fc020ae61c9caf771e625e89749
SHA1bf1458661cdf795ac8090895f3f560b066a30a29
SHA256592a9c8782ed22a58d3b2aa19e43f60ca64562ab737094ffb8ccc5215669ee52
SHA512cb0360129a06ab1aef930a222b526c545338f03fd6f06049d17ec04837f1bf173a4b02d355b0b933f8b2ba364ca0e3fdbbd3e8c2451f5531de4b91463e2a851b