Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
CFXBypass.exe
Resource
win7-20240708-en
General
-
Target
CFXBypass.exe
-
Size
554KB
-
MD5
613df599866679f7f19d12ff86220db8
-
SHA1
33a2f464888fd8aedd2c4cd8f79e9e43321d8465
-
SHA256
65f8e0e219637833386b6cfe27bd2f8446a214f02149628c63dd0329501e17e6
-
SHA512
4091dc9ce75e7ff9a1131aa200e30ca293a8619a616bce17a4f5fa6e79602848efd422be64be7af8aff3c99f75536d2ea45dbcf1d7afb0a7998a0526bf76ce13
-
SSDEEP
12288:2Nqf82rBbd4Qlj68ZEpv/7B+WIOzys7AsMC6WReVDTKwWZwfwsBAlny7Jc23OBuB:2s82ZWQx6AKsWL
Malware Config
Extracted
lumma
https://extorteauhhwigw.shop/api
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://swellfrrgwwos.xyz/api
https://penetratedpoopp.xyz/api
https://ellaboratepwsz.xyz/api
https://towerxxuytwi.xyz/api
https://pedestriankodwu.xyz/api
Extracted
lumma
https://potterryisiw.shop/api
https://foodypannyjsud.shop/api
https://contintnetksows.shop/api
https://tenntysjuxmz.shop/api
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3212 CFXBypass.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3212 set thread context of 3592 3212 CFXBypass.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFXBypass.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_regiis.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3212 wrote to memory of 3592 3212 CFXBypass.exe 87 PID 3212 wrote to memory of 3592 3212 CFXBypass.exe 87 PID 3212 wrote to memory of 3592 3212 CFXBypass.exe 87 PID 3212 wrote to memory of 3592 3212 CFXBypass.exe 87 PID 3212 wrote to memory of 3592 3212 CFXBypass.exe 87 PID 3212 wrote to memory of 3592 3212 CFXBypass.exe 87 PID 3212 wrote to memory of 3592 3212 CFXBypass.exe 87 PID 3212 wrote to memory of 3592 3212 CFXBypass.exe 87 PID 3212 wrote to memory of 3592 3212 CFXBypass.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\CFXBypass.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3592
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
429KB
MD5f6ba3a613a9d9be4b2b93c8ec849d239
SHA1dadd356e8b028fd7ce67e91ddea68b4928a146d3
SHA256d66df0795ea1a1941802c75c10603a6ad3b162ded9153f3623c3816e81e47bba
SHA5120b02ddc1208abdc270637992d15ca64154b7dc5fd5420df3b5a6253655050f415f983aaed06427b3d30315a406b3c6a98d5487a9d5ad5df863cddaa9b2a92989