Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/04/2024, 17:18

General

  • Target

    6fd67ca0062f09a5d839f9de4d01314fb7b434c0a987731d514af09ae97750e7.exe

  • Size

    41KB

  • MD5

    542adcb1bd6f3734ff7f097808f11436

  • SHA1

    417b78f2845555d795fc7b14658f3358e806ca8f

  • SHA256

    6fd67ca0062f09a5d839f9de4d01314fb7b434c0a987731d514af09ae97750e7

  • SHA512

    a4f9ca8cd6d8a963ed84563c48bd41a34e7c3754f324b66cdaf131260c4502cc1d17fa125c904c4be61557a85727df7a2a6f416b86b08e4e8e4112ee12e54582

  • SSDEEP

    768:xeMc5VwWt1jDkbXdnTOyQxHFO+IxX2P5LIbbcPYir2lAqcdF0i09Cy:xq5VwWDjDkdTRqHFOn8tIbbeYiuZIFSz

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 24 IoCs
  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fd67ca0062f09a5d839f9de4d01314fb7b434c0a987731d514af09ae97750e7.exe
    "C:\Users\Admin\AppData\Local\Temp\6fd67ca0062f09a5d839f9de4d01314fb7b434c0a987731d514af09ae97750e7.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4448
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:3704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    0cf3be5d54cf93ad7c8b92ffaeaa3c9f

    SHA1

    387d8bd7cc08ed424680c80c3bee3a442981c54b

    SHA256

    8a27999e0ccaeeec2ac15ea8a8b346e0b80730b94a261238b0a9cd01dfa60f7d

    SHA512

    28f09646fb2b7f4f754b8c90d86198081c3140e84cecbbe90629a9b6fcf2744d0e1d06742dd6150c220e8da959ee432f173aafb732ce018b4ccb7da1b7dfaba8

  • C:\Windows\SysWOW64\grcopy.dll

    Filesize

    41KB

    MD5

    9a21ac7e7f823410720fb6553e8f0248

    SHA1

    bbcd31119e751bcffc0a890874b547c6c7729d1b

    SHA256

    9dfee27006809b027e6529e5b7db86b1d7745036268b702754aa15cdfc660dff

    SHA512

    94293b645156d726e0f4bf4dd4b8d66cbe01e8e7bbf5e51dd33accfb6a7fe623b625d56adb24bf297dbc404644b861d27e442cc97db123f2f47928ce597eb4ce

  • C:\Windows\SysWOW64\satornas.dll

    Filesize

    183B

    MD5

    c0bdc6b2a9636a3ef5f27208cd565057

    SHA1

    91d3e0fd3126c5bebcfcb2d61e808686b49729c0

    SHA256

    be5421625ff4d9a3139e927a10458807d78766aa27719f5de147b668dffabd44

    SHA512

    d733b22a198fd30107f1ddf44f4c6d2eadb51a1f6211ed32150aee87e9d7b1db94395e31a6f44d412170765fcbe487ea1cc5f641a9e57d4e88d1086199c5289e

  • C:\Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    e1993c2a6e7ce7af90969b56824ec9a2

    SHA1

    9fcba17b70b8517155f0f705953bd242e88b4e0d

    SHA256

    5224ee5ddf5db4fe5d70b6d998b5f7583773bfe8dbadd7d5b309639c24f55603

    SHA512

    e3364145e3c2c1ccbc34fe3f74aec08ddf0a0ff33b3b6842cc9bb4a5b893c2eccadb4a6b6b3fdf4d70f81d44eb9a2b0d4b78f853d526827a7a33d273f101f685

  • memory/3540-18-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/3540-21-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3540-24-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/3540-0-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-39-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-49-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-36-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/3704-37-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-63-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-41-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-43-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-45-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-47-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-33-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-51-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-53-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-55-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-57-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-59-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3704-61-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4448-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB