Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 20:17
Behavioral task
behavioral1
Sample
3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe
Resource
win10v2004-20240611-en
General
-
Target
3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe
-
Size
64KB
-
MD5
fdaf4ae9da9ca12d8f75f58f89dbbb0f
-
SHA1
330fc088e9f4bd51bf68174a945d716c12295dbf
-
SHA256
3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1
-
SHA512
11970e1328a38f887419e1ed4683137b64b1bb49234890ab6c4e87d80ff758da9fad39a6e92730e950ad7c21f580d1df22990d54a8152603f73edc2ddb412cb7
-
SSDEEP
1536:y4QQ6NSyM61l19piO+LV8YEoI/EU9RUe4mz5U8klBrnn:y4X6NSyfnpijeYEoIcq4E5H8nn
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4392-0-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral2/files/0x0007000000023562-6.dat upx behavioral2/memory/4392-29-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe" 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe -
Drops file in System32 directory 27 IoCs
description ioc Process File created C:\Windows\SysWOW64\macromd\DivX pro key generator.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\Jenna Jamison Dildo Humping.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\Blonde and Japanese girl bukkake.mpg.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\Pamela Anderson And Tommy Lee Home Video (Part 1).mpg.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\girls gone wild.mpg.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\Britney Spears Dance Beat.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\XXX Porn Passwords.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\ICQ Hackingtools.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\Winzip.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\winxcfg.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\siemens unlocker.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\Pamela Anderson.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\aimcracker.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\pamela anderson naked.mpg.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\Harry Potter and the sorcerors stone.divx.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\yahoo cracker.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\preteen snuff sex rape with a stick hardcore.mpg.pif 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\jenna jameson - shower scene.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\GTA 3 Serial.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\Warcraft 3 battle.net serial generator.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\15 year old on beach.mpg.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\CKY3 - Bam Margera World Industries Alien Workshop.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\AOL, MSN, Yahoo mail password stealer.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\divx pro.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\icqcracker.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\fetish bondage preteen porno.mpg.pif 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe File created C:\Windows\SysWOW64\macromd\Website Hacker.exe 3bc7b738526333ae4dd75e9c67e0a4816cd2d582bc91290d30507193d18799f1.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5023a4d0e0eec6662b5701b87387a9c9c
SHA173e3a3fcdcf14b73eafbf3fe55cb9ae55fc26962
SHA256ebae7998b5b8b29eab60302356b36d4b1cc0e531324adfe9554f96b21187c435
SHA51233a9bb53bb532e7a9d1736448dbf6f8455bf77baadbc60b192a847610f13d651af89207365368585e740b6786812653ba76d6dcbb613491a0788fd7a5b5f47f2