Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03/07/2024, 05:05
General
-
Target
f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe
-
Size
841KB
-
MD5
6b34e2289e78e1e251655b8da5b7446c
-
SHA1
c74c065b9169e1ae7ee01d4bcdd265e25a22595d
-
SHA256
f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597
-
SHA512
6d469c34b74696b19ae32ce07aa98917ed11d3db15f339a0a456bf93e2005f2c0af42f5e34e94d06893cc7906ff5de5ba6bc1c243544ed586d64bd8444a041f6
-
SSDEEP
12288:faWzgMG7v3qnCiLErQohhQb4cCJ8lnyuQ4BgWlRPT0lBjvrEH7Hn:CaH2v6CTrj+nyuQ4hRPUrEH7H
Malware Config
Signatures
-
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
-
Detects Floxif payload 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 4 IoCs
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe"C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe"C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe" /P:4590302⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe"C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe" /P:4590303⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe"C:\Users\Admin\AppData\Local\Temp\f9dfd791515ca089de8b77257d47e0ef0349fee7f1917769841cd3a086157597.exe" /TI/ /P:4590304⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
29KB
MD531c5a8d7f0d900bfff09d437a7457478
SHA1c32f7abbc47949c340a2136bb8cc4787f05b1eff
SHA25689da44ebaa36a31740f9dbc585cefc3f55cf725f7d8d745b44ba259f0a1d8455
SHA5120089a7e5e0c3d7b8a226775f30983e901b323846d5263366672390ebbbd9212bd72bdb87c7baeeb09c6438317a66f5ccfc20cd898579190e6bb7579dd1cd158a
-
Filesize
29KB
MD5c857a930b241455b7961a16c96ddf256
SHA140f6df790dc7bc1e7daa1f48a729453a2ffd9efa
SHA256b2023c405900d194c0a00ea1cabefa96f3abcb73c2da88c3802594811a128bbc
SHA512702b4c9327cddd5d8baac050376143e42ac4632afb0e1b605a0d3a7d448a9f570296981b509f66cab56926a6c52bb8fd90b6014a89d433e3b8f41396b6fe7bcb
-
Filesize
764KB
MD5408dd6ade80f2ebbc2e5470a1fb506f1
SHA1e00293ce0eb534874efd615ae590cf6aa3858ba4
SHA2564c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71
SHA5124dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0
-
Filesize
3KB
MD555a68f2ddffff4dea1192d3553270b67
SHA16dbcec6e8d7efafa1b146c42b6a8c5410b733490
SHA256e344050ca6b89c9f63b36824663ee81ec6ecdce9640374060c3c581ecec6cf08
SHA5123a618f4f257f0eba40078023f0767b55a0d89d04b086328d9a63f04980a872f0f5945b942534d69c97a2991710014817467914a32f3904e5b681d9f455cdf600
-
Filesize
29KB
MD5a69e54b63a067cefab41736717e9348b
SHA196e00b5f3170d19d173e62b97c1691fac8edfb98
SHA256c72184932dd0541095be4827e5f86b3db735cfc651f04b50a1cc783d9037d75d
SHA51213385b98377cb664907a5189cbf63f575c86b5b705df2a458ae21c6fd63f6cbf77451e8f17b22af8921a3342f31445278cb8450e1cc58fe33eecffe81e56cdda
-
Filesize
29KB
MD51c9fed3d9916075d80c21e1fddc30412
SHA15bc7f275a846ae135e655549c27ebd02210fdb3b
SHA256c51bdd9882e9e515838b663120d9303d30a01fe0b3bec498c1311072ccda61d9
SHA51272e512bf1ed285126fe58084949d9f4be2a98fc8e196743fcd6bd5340bff36c294c18c7581562dda88435b24b4a5234ac189818e0d0e017bb4cfcbe0b11deec4
-
Filesize
11KB
MD5c87a407a6decc862e3132efc8ab504c9
SHA120cd713fa491119aabfd25a7cce7a8209098f903
SHA256439de9f662754bbcfc211658ce3f1c1730e85df199ed1e067940e28831d2c758
SHA5128bed0ca582ca5b46f0c6922995343388df0d84d063512308d3f58c31da1811cb2c47b87be0ce5de4a1fb8ce14f89f8f3197f31bb0ca989fa159514f6751e1832
-
Filesize
10KB
MD5bdb4dcbcec51d9ee1afee83221921fee
SHA121d56a9334238297d1a09aba46043cc36c9e2d3c
SHA2569e5d8505b986e40cce00707180334fead34c0c3b590c458305de89e4bbc85f75
SHA512cad20e6355cfe1e42a4ee7f5350a033ec79b8ed2689d8c6fa11bb1c3ae2a99425f03d95312ed9daf5c2543fc7ce38239fca41700cbecbc02a007a669ffd81fa5
-
Filesize
5KB
MD53886aae8ae30f288363ce4d2ac4f81c2
SHA119441c886b57ed9f4650f614f0d93501d0a33e40
SHA25637f10f3d46a2886cac6169a398e91dd8cd0cfd06a7b6812e1afb68c4c031b9fd
SHA512b37aa26a5324723d9b8a7b919c3727565a1e1974ba1316093b59dbe4a75f5e0773288894d7abb403d65688e0e3f29ef4b48af7a8048e64fe36199bf8d371fb31
-
Filesize
192KB
-
Filesize
12KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
192KB
-
Filesize
728KB
-
Filesize
192KB
-
Filesize
728KB
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
192KB