Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

17/04/2024, 12:16

240417-pfx1vsfh7v 10

17/04/2024, 12:16

240417-pfxebsed54 10

17/04/2024, 12:16

240417-pfwsssed52 10

17/04/2024, 12:16

240417-pftcnsed48 10

17/04/2024, 12:16

240417-pfsq5sfh7s 10

16/04/2024, 13:45

240416-q2cgqada9t 10

Analysis

  • max time kernel
    300s
  • max time network
    297s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/04/2024, 13:45

General

  • Target

    90f68e40e22da341888a881fa701d0a26adbfb8a62693044d137826fc1c677fa.exe

  • Size

    1.3MB

  • MD5

    1ca13ce3fd4bc03072da2c09923cea0d

  • SHA1

    a7e301c835a2543778751ccd37d4d442f18f19fe

  • SHA256

    90f68e40e22da341888a881fa701d0a26adbfb8a62693044d137826fc1c677fa

  • SHA512

    54be0c00ec5f5f1d8663e912ebb503f41a94ff003babf4ed9c49bc2ead32ec46127ea191014e2e607e5395104626d2d2b4af8f3bad8c04684d101a0f76d8e09d

  • SSDEEP

    12288:hD0Yxtmgcj3DKjs16MKYIjhy+AC5j6vfNqr:hQYxtmiEEYIjhyQj6vfNqr

Score
10/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90f68e40e22da341888a881fa701d0a26adbfb8a62693044d137826fc1c677fa.exe
    "C:\Users\Admin\AppData\Local\Temp\90f68e40e22da341888a881fa701d0a26adbfb8a62693044d137826fc1c677fa.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
      "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
      2⤵
      • Executes dropped EXE
      PID:2508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

    Filesize

    3KB

    MD5

    b4cd27f2b37665f51eb9fe685ec1d373

    SHA1

    7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

    SHA256

    91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

    SHA512

    e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

  • C:\Users\Admin\AppData\Local\Temp\x64btit.txt

    Filesize

    28B

    MD5

    c1b605fa634bc8e7c47db689063ac6fe

    SHA1

    b228a6e64da067d92b8bd4ee1af1b26b57895181

    SHA256

    c8c3710066c8ef4a0e81c6567fa974ab2859ee564d6306aaa820d1869533f6e2

    SHA512

    59933000dad83109c83be7f7ec57b4af5b12f3c0fc7a71840ab2070ba70b1a0c7fc430bef8d3fc7a563996b9c6baef07f21697335fbfee23080b02e16ba9a6c6

  • memory/4488-15-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-18-0x0000000000400000-0x00000000051BC000-memory.dmp

    Filesize

    77.7MB

  • memory/4488-5-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-6-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-7-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-8-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-3-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-1-0x0000000005270000-0x0000000005370000-memory.dmp

    Filesize

    1024KB

  • memory/4488-2-0x00000000056B0000-0x0000000005717000-memory.dmp

    Filesize

    412KB

  • memory/4488-16-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-17-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-4-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-19-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-23-0x0000000005270000-0x0000000005370000-memory.dmp

    Filesize

    1024KB

  • memory/4488-22-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-25-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-27-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-30-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-35-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-36-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB

  • memory/4488-39-0x0000000005720000-0x00000000057E6000-memory.dmp

    Filesize

    792KB