Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/04/2024, 12:16

240417-pfx1vsfh7v 10

17/04/2024, 12:16

240417-pfxebsed54 10

17/04/2024, 12:16

240417-pfwsssed52 10

17/04/2024, 12:16

240417-pftcnsed48 10

17/04/2024, 12:16

240417-pfsq5sfh7s 10

16/04/2024, 13:45

240416-q2cgqada9t 10

Analysis

  • max time kernel
    301s
  • max time network
    190s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/04/2024, 13:45

General

  • Target

    90f68e40e22da341888a881fa701d0a26adbfb8a62693044d137826fc1c677fa.exe

  • Size

    1.3MB

  • MD5

    1ca13ce3fd4bc03072da2c09923cea0d

  • SHA1

    a7e301c835a2543778751ccd37d4d442f18f19fe

  • SHA256

    90f68e40e22da341888a881fa701d0a26adbfb8a62693044d137826fc1c677fa

  • SHA512

    54be0c00ec5f5f1d8663e912ebb503f41a94ff003babf4ed9c49bc2ead32ec46127ea191014e2e607e5395104626d2d2b4af8f3bad8c04684d101a0f76d8e09d

  • SSDEEP

    12288:hD0Yxtmgcj3DKjs16MKYIjhy+AC5j6vfNqr:hQYxtmiEEYIjhyQj6vfNqr

Score
10/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90f68e40e22da341888a881fa701d0a26adbfb8a62693044d137826fc1c677fa.exe
    "C:\Users\Admin\AppData\Local\Temp\90f68e40e22da341888a881fa701d0a26adbfb8a62693044d137826fc1c677fa.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:364
    • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
      "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
      2⤵
      • Executes dropped EXE
      PID:3192

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

    Filesize

    3KB

    MD5

    b4cd27f2b37665f51eb9fe685ec1d373

    SHA1

    7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

    SHA256

    91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

    SHA512

    e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

  • C:\Users\Admin\AppData\Local\Temp\x64btit.txt

    Filesize

    28B

    MD5

    717ce48d668099f8a932d1fa5f3e8392

    SHA1

    f303045359706db9b65a9b91a32ece10349b1d26

    SHA256

    623209d62f42ca642f14c24055436f1e6bcf40e01088a42ecfe1596bcff3cfbe

    SHA512

    5c45a7c7355982212ba53fccc7d8946d2a0582f6d1eb309ea90568b5246de4beb56ce76f911d75e31bc139f5f34d522b30b0894c7fb3eb298852e90978c04ccd

  • memory/364-17-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-15-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-5-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-6-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-7-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-8-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-3-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-20-0x0000000005220000-0x0000000005320000-memory.dmp

    Filesize

    1024KB

  • memory/364-18-0x0000000000400000-0x00000000051BC000-memory.dmp

    Filesize

    77.7MB

  • memory/364-16-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-4-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-1-0x0000000005220000-0x0000000005320000-memory.dmp

    Filesize

    1024KB

  • memory/364-2-0x0000000005630000-0x0000000005697000-memory.dmp

    Filesize

    412KB

  • memory/364-21-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-25-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-30-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-36-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-38-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-39-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-43-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-45-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-47-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB

  • memory/364-50-0x00000000056C0000-0x0000000005786000-memory.dmp

    Filesize

    792KB