Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3FF 777v2.rar
windows10-2004-x64
3FlightFact...-1.png
windows10-2004-x64
3FlightFact...-2.png
windows10-2004-x64
3FlightFact...-3.png
windows10-2004-x64
3FlightFact...-4.png
windows10-2004-x64
3FlightFact...er.exe
windows10-2004-x64
10FlightFact...on.txt
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
FF 777v2.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
FlightFactor 777 v2 (dev)/777-1.png
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
FlightFactor 777 v2 (dev)/777-2.png
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
FlightFactor 777 v2 (dev)/777-3.png
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
FlightFactor 777 v2 (dev)/777-4.png
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
FlightFactor 777 v2 (dev)/FlightFactor Manager.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
FlightFactor 777 v2 (dev)/Installation.txt
Resource
win10v2004-20240508-en
General
-
Target
FF 777v2.rar
-
Size
2.3MB
-
MD5
245b3bc12c33013b0927cbd4643650da
-
SHA1
d71a4b13e4e3502015336e1ce7b6cece03050232
-
SHA256
1f6ea88eaaa558d0384646b4b08df371fb1a45a8e8640e6587c2051b6618ffb7
-
SHA512
8773c3fca6d9e58d20ffa3a992c3be0a2b387fc7539aa9b3172b197253bdc1b05dbb986d4d1e83878d621f1132b1d723cf47e1d9a24c1e6a0fd25b5b8825ce71
-
SSDEEP
49152:t6qbxOw5W9DoEbSDr1DJYb1fSXC8//yzbSRWSdlxJ/pdgyH:tdxb5HEyr1JkpSXh/ySRWSdlxJBq6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2776 OpenWith.exe -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe 2776 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\FF 777v2.rar"1⤵
- Modifies registry class
PID:4088
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2776
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4720