Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
fncheets.exe
-
Size
6.9MB
-
Sample
240914-a11vxsxgpj
-
MD5
cd4aaaf8df2eb9f5017a591a325de881
-
SHA1
f4499567ebc3987bc11140f9fe91854e31553acf
-
SHA256
85e1b46e08e60f8463272bcc010ee483e2a9947a9c018e2ce178fa3558218869
-
SHA512
44e3bb70a1314a0c3e29071562e99fdec6d4c907e05e4634034369ce4779df4d6142e5216a5d492f0e0a043634244172add3f8f6768806a2af56233292fec792
-
SSDEEP
98304:D9vITBgZ7amaHl3Ne4i3lqoFhTWrf9eQc0MJYzwZNqkzQZs5J1n6ksBnrNAM5:DpI3eNlpYfMQc2sJhn6ksV/
Behavioral task
behavioral1
Sample
fncheets.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fncheets.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
fncheets.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
fncheets.exe
Resource
win11-20240802-en
Malware Config
Targets
-
-
Target
fncheets.exe
-
Size
6.9MB
-
MD5
cd4aaaf8df2eb9f5017a591a325de881
-
SHA1
f4499567ebc3987bc11140f9fe91854e31553acf
-
SHA256
85e1b46e08e60f8463272bcc010ee483e2a9947a9c018e2ce178fa3558218869
-
SHA512
44e3bb70a1314a0c3e29071562e99fdec6d4c907e05e4634034369ce4779df4d6142e5216a5d492f0e0a043634244172add3f8f6768806a2af56233292fec792
-
SSDEEP
98304:D9vITBgZ7amaHl3Ne4i3lqoFhTWrf9eQc0MJYzwZNqkzQZs5J1n6ksBnrNAM5:DpI3eNlpYfMQc2sJhn6ksV/
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3