Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 15:56
Static task
static1
Behavioral task
behavioral1
Sample
f73ed2285c7d5a238bebcef71d7a0c30N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f73ed2285c7d5a238bebcef71d7a0c30N.exe
Resource
win10v2004-20240802-en
General
-
Target
f73ed2285c7d5a238bebcef71d7a0c30N.exe
-
Size
482KB
-
MD5
f73ed2285c7d5a238bebcef71d7a0c30
-
SHA1
acaff115fd0d88b668399a78b13c1de6db2e1af2
-
SHA256
74c8aea534b21648aa52454b9e365129bc20efc47f6714ea4610e64bd343baee
-
SHA512
9fb9822216bb1a9ada499ed3e39a7601e2782d0474160348762c7762c200c06272d57000a484122c56ac9f12048ab2289fe432faa3d748c45ebf6bce21a26dba
-
SSDEEP
12288:T3lc87eqqV5e+wBV6O+VkSq9HrwV+6Ix6hFpJBbopMb:T3SqqHeVBxd9Hrw+6Ix6WpMb
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1208 Fondfmon.exe 952 backOUTE.exe 4744 ~5B4A.tmp -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\forftugc = "C:\\Users\\Admin\\AppData\\Roaming\\Checst3g\\Fondfmon.exe" f73ed2285c7d5a238bebcef71d7a0c30N.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\backOUTE.exe f73ed2285c7d5a238bebcef71d7a0c30N.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fondfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language backOUTE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f73ed2285c7d5a238bebcef71d7a0c30N.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1208 Fondfmon.exe 1208 Fondfmon.exe 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE 3492 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1208 Fondfmon.exe Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE Token: SeShutdownPrivilege 3492 Explorer.EXE Token: SeCreatePagefilePrivilege 3492 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3492 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4632 wrote to memory of 1208 4632 f73ed2285c7d5a238bebcef71d7a0c30N.exe 95 PID 4632 wrote to memory of 1208 4632 f73ed2285c7d5a238bebcef71d7a0c30N.exe 95 PID 4632 wrote to memory of 1208 4632 f73ed2285c7d5a238bebcef71d7a0c30N.exe 95 PID 1208 wrote to memory of 4744 1208 Fondfmon.exe 97 PID 1208 wrote to memory of 4744 1208 Fondfmon.exe 97 PID 4744 wrote to memory of 3492 4744 ~5B4A.tmp 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\f73ed2285c7d5a238bebcef71d7a0c30N.exe"C:\Users\Admin\AppData\Local\Temp\f73ed2285c7d5a238bebcef71d7a0c30N.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Roaming\Checst3g\Fondfmon.exe"C:\Users\Admin\AppData\Roaming\Checst3g"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\~5B4A.tmp3492 493576 1208 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744
-
-
-
-
C:\Windows\SysWOW64\backOUTE.exeC:\Windows\SysWOW64\backOUTE.exe -s1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:952
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4156,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:81⤵PID:3644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
482KB
MD5ae14f79058c18dbd05ff31c99af96e76
SHA174951b93431e3e01d322ddae04262a45986a139f
SHA256713bf95ebdce386e2a610c9d7ddfd7706c3a5fa2ba52b3b7ff07c5e6824e78ff
SHA51288acc77f1c9aff210868a18d9304434c5a093a09ec69d4b85a9edc5c8e84032c7c0a928fff0abd1b8ec24e895b158538738c45e7d1138014fb25eba27d31d4b1