Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
03/07/2024, 05:05
General
-
Target
f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe
-
Size
841KB
-
MD5
6b34e2289e78e1e251655b8da5b7446c
-
SHA1
c74c065b9169e1ae7ee01d4bcdd265e25a22595d
-
SHA256
f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597
-
SHA512
6d469c34b74696b19ae32ce07aa98917ed11d3db15f339a0a456bf93e2005f2c0af42f5e34e94d06893cc7906ff5de5ba6bc1c243544ed586d64bd8444a041f6
-
SSDEEP
12288:faWzgMG7v3qnCiLErQohhQb4cCJ8lnyuQ4BgWlRPT0lBjvrEH7Hn:CaH2v6CTrj+nyuQ4hRPUrEH7H
Malware Config
Signatures
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 7 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe"C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe"C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe" /P:3935022⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe"C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe" /P:3935023⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe"C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe" /TI/ /P:3935024⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240703050523.log C:\Windows\Logs\CBS\CbsPersist_20240703050523.cab1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
29KB
MD531c5a8d7f0d900bfff09d437a7457478
SHA1c32f7abbc47949c340a2136bb8cc4787f05b1eff
SHA25689da44ebaa36a31740f9dbc585cefc3f55cf725f7d8d745b44ba259f0a1d8455
SHA5120089a7e5e0c3d7b8a226775f30983e901b323846d5263366672390ebbbd9212bd72bdb87c7baeeb09c6438317a66f5ccfc20cd898579190e6bb7579dd1cd158a
-
Filesize
764KB
MD5408dd6ade80f2ebbc2e5470a1fb506f1
SHA1e00293ce0eb534874efd615ae590cf6aa3858ba4
SHA2564c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71
SHA5124dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0
-
Filesize
3KB
MD56673e8b8c340bba29b00dd1ae48c5509
SHA153c6a2784ee430037cc7bfc3eb939bb7f6eff2e8
SHA256ccfd67ddb78322d8524c34d0392a4ddf6a8b9cb1c23dc21977e02a08b19a7dda
SHA512dace244b83cac5fe7eb3703e4ae79d35bcc8d5e1c23f3fa4f725b61b6ea46d5b0a741ad2b675ea8501d69dfdba6cd27c1c20059acee7fa83f15c085f4cbdb404
-
Filesize
29KB
MD51c9fed3d9916075d80c21e1fddc30412
SHA15bc7f275a846ae135e655549c27ebd02210fdb3b
SHA256c51bdd9882e9e515838b663120d9303d30a01fe0b3bec498c1311072ccda61d9
SHA51272e512bf1ed285126fe58084949d9f4be2a98fc8e196743fcd6bd5340bff36c294c18c7581562dda88435b24b4a5234ac189818e0d0e017bb4cfcbe0b11deec4
-
Filesize
29KB
MD5c857a930b241455b7961a16c96ddf256
SHA140f6df790dc7bc1e7daa1f48a729453a2ffd9efa
SHA256b2023c405900d194c0a00ea1cabefa96f3abcb73c2da88c3802594811a128bbc
SHA512702b4c9327cddd5d8baac050376143e42ac4632afb0e1b605a0d3a7d448a9f570296981b509f66cab56926a6c52bb8fd90b6014a89d433e3b8f41396b6fe7bcb
-
Filesize
11KB
MD5c87a407a6decc862e3132efc8ab504c9
SHA120cd713fa491119aabfd25a7cce7a8209098f903
SHA256439de9f662754bbcfc211658ce3f1c1730e85df199ed1e067940e28831d2c758
SHA5128bed0ca582ca5b46f0c6922995343388df0d84d063512308d3f58c31da1811cb2c47b87be0ce5de4a1fb8ce14f89f8f3197f31bb0ca989fa159514f6751e1832
-
Filesize
10KB
MD5bdb4dcbcec51d9ee1afee83221921fee
SHA121d56a9334238297d1a09aba46043cc36c9e2d3c
SHA2569e5d8505b986e40cce00707180334fead34c0c3b590c458305de89e4bbc85f75
SHA512cad20e6355cfe1e42a4ee7f5350a033ec79b8ed2689d8c6fa11bb1c3ae2a99425f03d95312ed9daf5c2543fc7ce38239fca41700cbecbc02a007a669ffd81fa5
-
Filesize
5KB
MD53886aae8ae30f288363ce4d2ac4f81c2
SHA119441c886b57ed9f4650f614f0d93501d0a33e40
SHA25637f10f3d46a2886cac6169a398e91dd8cd0cfd06a7b6812e1afb68c4c031b9fd
SHA512b37aa26a5324723d9b8a7b919c3727565a1e1974ba1316093b59dbe4a75f5e0773288894d7abb403d65688e0e3f29ef4b48af7a8048e64fe36199bf8d371fb31
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
12KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
192KB
-
Filesize
728KB
-
Filesize
192KB
-
Filesize
728KB
-
Filesize
192KB
-
Filesize
192KB