Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 20:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe
Resource
win7-20240611-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe
-
Size
407KB
-
MD5
5e9f41310effb06dd2a3532d66fd2cdf
-
SHA1
79736e3f664930447f20f14a9b3b328ed761dca9
-
SHA256
0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28
-
SHA512
7fae48ef836e8785ddbb8a5f7a7a3af73c178951b9c6638005440482680458652b96b3b89bb636ac09c30efab1ffc8db31615f575e9e96f67265a1bb875b6034
-
SSDEEP
6144:3w9D91dOrcN3ZGXNYFNmIkYvUIelVjjVtGRyFH4v:gtRfJcNYFNm8UhlZGsev
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 10 IoCs
flow pid Process 3 3060 rundll32.exe 5 3060 rundll32.exe 8 3060 rundll32.exe 9 3060 rundll32.exe 10 3060 rundll32.exe 13 3060 rundll32.exe 14 3060 rundll32.exe 15 3060 rundll32.exe 17 3060 rundll32.exe 18 3060 rundll32.exe -
Deletes itself 1 IoCs
pid Process 2756 rfkejgfae.exe -
Executes dropped EXE 1 IoCs
pid Process 2756 rfkejgfae.exe -
Loads dropped DLL 6 IoCs
pid Process 1984 cmd.exe 1984 cmd.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dotx = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\Program Files\\fjqupunqh\\rdfcs.dll\",Verify" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\z: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\u: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3060 rundll32.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\fjqupunqh rfkejgfae.exe File created \??\c:\Program Files\fjqupunqh\rdfcs.dll rfkejgfae.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2296 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe 3060 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3060 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1252 0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe 2756 rfkejgfae.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1984 1252 0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe 28 PID 1252 wrote to memory of 1984 1252 0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe 28 PID 1252 wrote to memory of 1984 1252 0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe 28 PID 1252 wrote to memory of 1984 1252 0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe 28 PID 1984 wrote to memory of 2296 1984 cmd.exe 30 PID 1984 wrote to memory of 2296 1984 cmd.exe 30 PID 1984 wrote to memory of 2296 1984 cmd.exe 30 PID 1984 wrote to memory of 2296 1984 cmd.exe 30 PID 1984 wrote to memory of 2756 1984 cmd.exe 31 PID 1984 wrote to memory of 2756 1984 cmd.exe 31 PID 1984 wrote to memory of 2756 1984 cmd.exe 31 PID 1984 wrote to memory of 2756 1984 cmd.exe 31 PID 2756 wrote to memory of 3060 2756 rfkejgfae.exe 32 PID 2756 wrote to memory of 3060 2756 rfkejgfae.exe 32 PID 2756 wrote to memory of 3060 2756 rfkejgfae.exe 32 PID 2756 wrote to memory of 3060 2756 rfkejgfae.exe 32 PID 2756 wrote to memory of 3060 2756 rfkejgfae.exe 32 PID 2756 wrote to memory of 3060 2756 rfkejgfae.exe 32 PID 2756 wrote to memory of 3060 2756 rfkejgfae.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe"C:\Users\Admin\AppData\Local\Temp\0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\rfkejgfae.exe "C:\Users\Admin\AppData\Local\Temp\0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2296
-
-
C:\Users\Admin\AppData\Local\Temp\rfkejgfae.exeC:\Users\Admin\AppData\Local\Temp\\rfkejgfae.exe "C:\Users\Admin\AppData\Local\Temp\0c9907387700a1b92bea706727f973cab6ac5666a0457d30407c93b8ff76be28.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\Program Files\fjqupunqh\rdfcs.dll",Verify C:\Users\Admin\AppData\Local\Temp\rfkejgfae.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD519427ad2bf37c029c8723360991dbf60
SHA1c1e8a99e2ac9e787dfbc6c9d2016aa02bb5ba906
SHA25676ab77a2e668be3d8512ba2caa0c3556683c426f5ad0a706adca37610fa6e0f2
SHA512ff49417f03ccd7762f47b2e2b420828cf9a5f84ce583c5bffc524d9737bee1fb3535f07f82a6a09b267a593253712c85b309ad6f2f72a997d50108353c68b0ed
-
Filesize
408KB
MD5559a42bc7ebf2a613645e879823f78c8
SHA1cf44ab0ae48bc73a0a98837185258cb7830b2e80
SHA2561d44c8c53193ae8a21cbc88aae624f1a52d87d8410938706d0820ee878d83059
SHA51211bd6ebccbb7775cbd75d1566707c72ba80679242dbf77898edfec8c76462bb360642123268d287ab6df2a3f501e6ae3e978f26917384648b782fa922a249a3b