Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1800s -
platform
windows11-21h2_x64 -
resource
win11-20240730-en -
resource tags
arch:x64arch:x86image:win11-20240730-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/08/2024, 14:43
Static task
static1
Behavioral task
behavioral1
Sample
EAYEEYZPFZ.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
EAYEEYZPFZ.exe
Resource
win10v2004-20240730-en
Behavioral task
behavioral3
Sample
EAYEEYZPFZ.exe
Resource
win11-20240730-en
General
-
Target
EAYEEYZPFZ.exe
-
Size
367KB
-
MD5
e1a8ca0eb72cbdd2a372c69a355d42be
-
SHA1
3d52f700bdb8e35ecbdd4238c2c4ca34644c467e
-
SHA256
81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb
-
SHA512
5a52f994513cb35ea2dbe85a330753517620a1f2aaba01de7517792491ee480f1db06cd943b16a5f6e6837001e51a2e6fcf6d8e6939b81b9279a36359a3a08eb
-
SSDEEP
6144:nRCm0GL3QgsA1dXNXWzdLfDMAWuvXOvjdVrHC8ndKN3mZPRNQNgHBfkKV8:nRSGT71ddXsmAWiXOvH/KZmZjsgaK2
Malware Config
Extracted
latrodectus
https://spikeliftall.com/live/
https://godfaetret.com/live/
Signatures
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Deletes itself 1 IoCs
pid Process 3812 EAYEEYZPFZ.exe -
Executes dropped EXE 4 IoCs
pid Process 744 confrontation_290a6ee2.exe 4972 confrontation_290a6ee2.exe 3792 confrontation_290a6ee2.exe 2980 confrontation_290a6ee2.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3812 EAYEEYZPFZ.exe 3812 EAYEEYZPFZ.exe 3812 EAYEEYZPFZ.exe 3812 EAYEEYZPFZ.exe 744 confrontation_290a6ee2.exe 744 confrontation_290a6ee2.exe 744 confrontation_290a6ee2.exe 744 confrontation_290a6ee2.exe 4972 confrontation_290a6ee2.exe 4972 confrontation_290a6ee2.exe 4972 confrontation_290a6ee2.exe 4972 confrontation_290a6ee2.exe 3792 confrontation_290a6ee2.exe 3792 confrontation_290a6ee2.exe 3792 confrontation_290a6ee2.exe 3792 confrontation_290a6ee2.exe 2980 confrontation_290a6ee2.exe 2980 confrontation_290a6ee2.exe 2980 confrontation_290a6ee2.exe 2980 confrontation_290a6ee2.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3812 EAYEEYZPFZ.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3812 wrote to memory of 744 3812 EAYEEYZPFZ.exe 82 PID 3812 wrote to memory of 744 3812 EAYEEYZPFZ.exe 82 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\EAYEEYZPFZ.exe"C:\Users\Admin\AppData\Local\Temp\EAYEEYZPFZ.exe"1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_290a6ee2.exe"C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_290a6ee2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:744
-
-
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_290a6ee2.exeC:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_290a6ee2.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4972
-
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_290a6ee2.exeC:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_290a6ee2.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3792
-
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_290a6ee2.exeC:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_290a6ee2.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
367KB
MD5e1a8ca0eb72cbdd2a372c69a355d42be
SHA13d52f700bdb8e35ecbdd4238c2c4ca34644c467e
SHA25681bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb
SHA5125a52f994513cb35ea2dbe85a330753517620a1f2aaba01de7517792491ee480f1db06cd943b16a5f6e6837001e51a2e6fcf6d8e6939b81b9279a36359a3a08eb