Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 04:42

General

  • Target

    f2cf3d2b0e4c8622e81e81be9df124c33ace3aff287836ac0c3122cff0725e2c.exe

  • Size

    5.0MB

  • MD5

    c106cc4d0f4566fc19919aea7860a0da

  • SHA1

    7a4237e490aade62724015a5c9721d481c603a17

  • SHA256

    f2cf3d2b0e4c8622e81e81be9df124c33ace3aff287836ac0c3122cff0725e2c

  • SHA512

    aca2fc9c8a4bbb33ed97b8cb7a9749a9d458c6bcfbbdc915138dc45fc9a914ecf2efc320efd47208d27d8b699a6a389510115df9c5327fb3146e87dc3ff064fd

  • SSDEEP

    98304:fG5Qz0XB2r24MzK1d6Q+08I2mo6v7aDrKAdj0PeE1QJHlEy3jZ6:fG5Vxm3qWQQb8IBlv7aDHYJcEyzZ6

Malware Config

Signatures

  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

  • Detects Floxif payload 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks for any installed AV software in registry 1 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2cf3d2b0e4c8622e81e81be9df124c33ace3aff287836ac0c3122cff0725e2c.exe
    "C:\Users\Admin\AppData\Local\Temp\f2cf3d2b0e4c8622e81e81be9df124c33ace3aff287836ac0c3122cff0725e2c.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\7zS8EB2BC06\GenericSetup.exe
      .\GenericSetup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Common Files\System\symsrv.dll.000

    Filesize

    175B

    MD5

    1130c911bf5db4b8f7cf9b6f4b457623

    SHA1

    48e734c4bc1a8b5399bff4954e54b268bde9d54c

    SHA256

    eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1

    SHA512

    94e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    48351d97ad555b7c7aa99c90680dca63

    SHA1

    a4553557bdec41deeb737c27bda32134a0ec817e

    SHA256

    e487e47ea98ab7a3aadaf53d9a4aeecd4a32ff1916e7522b50f9862a05a1d168

    SHA512

    7c67aec593b810c4578208100b776a4bfb27972a080e62a6a5236ff11581fe96d1c6d45de57f5472045bc40c0215f4799af6e305c4508d21e182ba29fb970b95

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dd64c86c4e68f45c7d94941c33c52a06

    SHA1

    03e4118ce997b5e0311867a6456ffecfd524cb43

    SHA256

    4435845418a8f0b8d51d6a49e27aaefdc3bb4f7f29fc6d1eb037c48a03a1a4c0

    SHA512

    fdea6454748becec0be6ebda8b63f808ac7a966f750723ad24411e1db96893e130b470f17e3d0c15a527eab3e7394666a79dff33b7ae384fbde48f67361ba2a5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    06295d0e1a518dd7a92be1446ca06936

    SHA1

    037dc072122ed4b299ebb86a33dd325727a1c12e

    SHA256

    cfaed3091a5d0f9e4c9d203ff1a36567de97137d459665b132634b0928d4f8b9

    SHA512

    ee3aaaeb5e08dd5eb93c46f7f505eaafee29f0f3cf7051d8ae5fa16996186133930a6f51b66cfcea46055501e829ddf180e576b6b61febe65a62eb6cd69ac31c

  • C:\Users\Admin\AppData\Local\Temp\7zS8EB2BC06\GenericSetup.exe.config

    Filesize

    814B

    MD5

    fd63ee3928edd99afc5bdf17e4f1e7b6

    SHA1

    1b40433b064215ea6c001332c2ffa093b1177875

    SHA256

    2a2ddbdc4600e829ad756fd5e84a79c0401fa846ad4f2f2fb235b410e82434a9

    SHA512

    1925cde90ee84db1e5c15fa774ee5f10fa368948df7643259b03599ad58cfce9d409fd2cd752ff4cbca60b4bbe92b184ff92a0c6e8b78849c4497d38266bd3b4

  • C:\Users\Admin\AppData\Local\Temp\Cab168F.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\GenericSetup.exe_1719981774\Resources\OfferPage.html

    Filesize

    1KB

    MD5

    2b8bd3554f6a6dc03f37c0bbdab769dc

    SHA1

    3592b1edcb43bb32c87b674d9d314aedde334f93

    SHA256

    c74761837d4619c8efea300d129d3c650a844fb4bc2cbba6e9bc98ac6eec0d87

    SHA512

    ddf84a43ec441246f8ebd70a596d03728fe92956d1e50f1d1f757f006ea4d5173b38cbfc0606887201366cdac6ba8365010210b06a29b6c3bab538b5ea335940

  • C:\Users\Admin\AppData\Local\Temp\Tar16A1.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

  • C:\Users\Admin\AppData\Local\Temp\Tar1784.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Program Files\Common Files\System\symsrv.dll

    Filesize

    67KB

    MD5

    7574cf2c64f35161ab1292e2f532aabf

    SHA1

    14ba3fa927a06224dfe587014299e834def4644f

    SHA256

    de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

    SHA512

    4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

  • \Users\Admin\AppData\Local\Temp\7zS8EB2BC06\GenericSetup.exe

    Filesize

    9.9MB

    MD5

    6da11d5aea63f1b1ed3f2c566e48de6c

    SHA1

    9cd0401b48837b103aa79ccb5cc04d406a415fc9

    SHA256

    d6e22eab0a67834fa39286c98820c2938e8de4f4f3dab635e578eef37e10b47b

    SHA512

    8f859e93e4d0fa67a5958ca89df0092c1e69c68aba5a8fc204aee1563059edbdf1650742c951ed01db87a9d08c9d77e0d7920d0fb4fdbd46c36f270cc2830bad

  • \Users\Admin\AppData\Local\Temp\GenericSetup.exe_1719981774\sciter32.dll

    Filesize

    5.6MB

    MD5

    b431083586e39d018e19880ad1a5ce8f

    SHA1

    3bbf957ab534d845d485a8698accc0a40b63cedd

    SHA256

    b525fdcc32c5a359a7f5738a30eff0c6390734d8a2c987c62e14c619f99d406b

    SHA512

    7805a3464fcc3ac4ea1258e2412180c52f2af40a79b540348486c830a20c2bbed337bbf5f4a8926b3ef98c63c87747014f5b43c35f7ec4e7a3693b9dbd0ae67b

  • memory/2692-40-0x0000000005800000-0x0000000005EDC000-memory.dmp

    Filesize

    6.9MB

  • memory/2692-32-0x00000000747DE000-0x00000000747DF000-memory.dmp

    Filesize

    4KB

  • memory/2692-43-0x0000000000A60000-0x0000000000A8C000-memory.dmp

    Filesize

    176KB

  • memory/2692-42-0x0000000000870000-0x0000000000898000-memory.dmp

    Filesize

    160KB

  • memory/2692-126-0x0000000007B90000-0x0000000007C0C000-memory.dmp

    Filesize

    496KB

  • memory/2692-41-0x0000000000860000-0x0000000000868000-memory.dmp

    Filesize

    32KB

  • memory/2692-152-0x00000000064B0000-0x00000000064DE000-memory.dmp

    Filesize

    184KB

  • memory/2692-39-0x00000000747D0000-0x0000000074EBE000-memory.dmp

    Filesize

    6.9MB

  • memory/2692-34-0x0000000001120000-0x0000000001B0C000-memory.dmp

    Filesize

    9.9MB

  • memory/2692-44-0x0000000004F10000-0x0000000004F22000-memory.dmp

    Filesize

    72KB

  • memory/2692-310-0x00000000747D0000-0x0000000074EBE000-memory.dmp

    Filesize

    6.9MB

  • memory/2692-307-0x00000000747DE000-0x00000000747DF000-memory.dmp

    Filesize

    4KB

  • memory/3048-305-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/3048-302-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/3048-9-0x000000000040E000-0x0000000000411000-memory.dmp

    Filesize

    12KB

  • memory/3048-313-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/3048-3-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/3048-316-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/3048-319-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/3048-320-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB