Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 22:12
Behavioral task
behavioral1
Sample
e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe
-
Size
6.1MB
-
MD5
7f2d736aa0bceadf56dd6dc94775fd45
-
SHA1
92fd856ea866c24051a7746093004da05e15ce89
-
SHA256
e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a
-
SHA512
aa2c6f97af7840ac69500efd545a6f5a3026515d18b1148274629aa450d9e9837bbdb2c742aede66ce6bdff5a5cc9025ca3310870a9a8d2b60f0b0cb76445085
-
SSDEEP
98304:lf38J8q4aW4CAHVgQhONQrbgNyYNWFpJhXk53++pLt/dWIxiCU/ouyGUkVNjPCeD:t38J6JNy6WhXk53Xthxo7mkNjP3yzh
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2516 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe -
resource yara_rule behavioral2/memory/2516-1-0x0000000140000000-0x0000000140629000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2516 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe -
Drops file in Windows directory 47 IoCs
description ioc Process File created C:\Windows\fudxac\UI\button_pushed.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\commmon.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\examine_background.bmp e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\firewall_ok.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\horizontal_border.bmp e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\preventnumber.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\lkz8pqu7\bq5nq0r0l.sys e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\AdhUiRes.zip e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\sys_dlg_menu.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\toolbar_normal.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\toolbar_pushed.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\softwaremanager.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\Module\ControlWindow\ControlWindow.dll e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\NoNoNoUse.txt e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\tabbar_hover.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\search_bg.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\networkshield.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\scrollbar.bmp e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\Module\ControlWindow\hkthunk64.dll e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\cloud.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\ComputerExamine.xml e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\icon.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\AdhRes.zip e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\skin.xml e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\Module\ControlWindow\ControlWindow.dll.__config.ini e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\dv.dat e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\sys_dlg_max.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\Module\ControlWindow\hkthunk.dll e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\tabbar_normal.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\tabbar_pushed.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\vertical_border.bmp e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\antivirus.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\sys_dlg_restore.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File opened for modification C:\Windows\lkz8pqu7\bq5nq0r0l.sys e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\button_hover.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\bg.jpg e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\Module\ControlWindow\cwapi_32.dll e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\Module\ControlWindow\GLLA.exe e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\Module\ControlWindow\remote.exe e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\toolbar_hover.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File opened for modification C:\Windows\fudxac\AdhLog.txt e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\firewall.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\navigationbar.bmp e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\skin.xml.bak e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\sys_dlg_close.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\sys_dlg_min.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\fudxac\UI\button_normal.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2516 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe 2516 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe 2516 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe 2516 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 648 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2516 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe"C:\Users\Admin\AppData\Local\Temp\e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2516
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD522a450a295e40400ef615fb0c1a265dd
SHA109c318c3096685c22c0ec2e0d310079c47818f63
SHA256d8920677d18a3a8a9ce347c46afbcf89ce0ac79dd86fae4c0a98bfc418c0f736
SHA512be6228b1ff6363a04841bbfebe1e70139a1655f711a1ce0a74550e33223d1561f4aea014ac0a833b4f1ef56b70101e1374cb77e6c4f4eb73b2bd879520dce9f6
-
Filesize
5KB
MD55e1f0b83012f5062585c8eb4e541c987
SHA18d8b44b8c3535c2d31d5fb05d2084372ab9e4ea5
SHA2568deeca6d245ed6456e689870c6a490cb20f281b23885171b518de66f4fd53c1b
SHA5120a8526cabec15ef281a2689013ea05b5385fcbfa97863dc178c07cb3bdc755683bb051ddbcf173624235cf4edaff53c0b9d28b8a12c95e0121c34cc958d81315
-
Filesize
949KB
MD5497d1af3a71c3af04d720abb4f96d9b2
SHA1d50d157c549b9db703fb6283d20d23dec0154596
SHA256b16405230e1be42383fe1eb1da6a9cead6d167706f57825cd283883b39f533c7
SHA5125364bae36bd6666d5d4af6996c6839ec3564b54a9f43cafc597d97d8ed8f0d4f39ed1b2f7c66461c95b1a369a8a9e1dbf6ba2e44b9aa428a208edfd7c6bfb977