Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 23:09

General

  • Target

    2f6d0f943d6a0bc76f573a6686008cc0N.exe

  • Size

    75KB

  • MD5

    2f6d0f943d6a0bc76f573a6686008cc0

  • SHA1

    2dc234f1fbe8dcb4731f4edd5cbf5b8fa71039b1

  • SHA256

    42581f5bea73e151c2b1b1156133709d95f21f6cf6779d0ee20a873b9925c60c

  • SHA512

    1ffd09748252255d4c6955c3c8911518cb116f0226f2590ddf5d854f6b0a117c33cad21dad01ada32ce4c35b1a531909dda4c4e4822ad3219afebea5d998864a

  • SSDEEP

    1536:Xx1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3B:BOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPp

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 19 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f6d0f943d6a0bc76f573a6686008cc0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2f6d0f943d6a0bc76f573a6686008cc0N.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Windows\SysWOW64\ctfmen.exe
      ctfmen.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3124
      • C:\Windows\SysWOW64\smnss.exe
        C:\Windows\system32\smnss.exe
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4092

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ctfmen.exe

    Filesize

    4KB

    MD5

    1aff6813687186544826e950c841883c

    SHA1

    ad0b0e72581b64443cfd594dd537e142e7132b3c

    SHA256

    ad05d19c981aac6a295f8740b6d36003cbc78a0ea281ee6d8efe185006918acb

    SHA512

    bafb33a184072a842bf34498dd3087490520aefc1e91113d392ff62210f329d5140979fc596b4ed5c31a14b1d65654d7d844d6ae07317db989d81b00c28e71dc

  • C:\Windows\SysWOW64\grcopy.dll

    Filesize

    75KB

    MD5

    9e61589db36a16a96a9ce892b756898c

    SHA1

    dda6bf15f834907cd580f7e11242e9ecb03e75d0

    SHA256

    43d9dd97e36238bc1565c537c12d92a06e454f131d708b5db6a2922b04503fc0

    SHA512

    5ca430a5a65577607307dcce63e35382fc304cfee0779d41261b3a44f61637d241efb073aed603f07422488150d0ac2bd1b33a96ce41a039ff50bbe97162356c

  • C:\Windows\SysWOW64\satornas.dll

    Filesize

    183B

    MD5

    dd9b4714c51bbf0c4ccced53c06584dc

    SHA1

    eec17c6a1df9432b348191386db2d7144bf590f6

    SHA256

    cf6ef18f11ff41d3283553074414a2cc93d43c513e7cd73de42e87ad04b7b8d1

    SHA512

    09aba614dacb2ee107aee94043c69a8c577722b32f8b242ac3a6d2f36688fcbf94cd0ab2f540c0cddb2216eef531e01e1f648b04a152e669bac8949e1500e956

  • C:\Windows\SysWOW64\shervans.dll

    Filesize

    8KB

    MD5

    61304526f92380088f7d517651514bfd

    SHA1

    5742218741c00b38a231d1cdc56a34b04dadc66f

    SHA256

    5b73840a6e9414a9caaca9922acc5b4051c2a28aab2a6e5d2264030219b9210f

    SHA512

    c8ae3940bc5415859feb9e4d4ec153ed4d0986a34cc4ec5996b1dddae3e3a76317171d401240c3c7e229f47b283803540a00bb512ddac6aed2d0bd9e306c79c9

  • memory/2508-23-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/2508-21-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/2508-12-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/3124-20-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3124-28-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/4092-37-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4092-35-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/4092-38-0x0000000010000000-0x000000001000D000-memory.dmp

    Filesize

    52KB

  • memory/4092-39-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4092-41-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4092-43-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4092-45-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4092-47-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4092-49-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4092-51-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4092-53-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4092-55-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB

  • memory/4092-57-0x0000000000400000-0x000000000041C000-memory.dmp

    Filesize

    112KB