Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5ecd777649...01.exe

windows7-x64

10

5ecd777649...01.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • submitted
    14/09/2024, 06:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5ecd777649462212355188b5ce8f26bb22673f7d280dfed8abcf055f4b819801.exe

  • Size

    74KB

  • MD5

    44f4535b67a92ec9d2c8952d2cc3bbbb

  • SHA1

    5a7328f5b737b9d855e5c33c9491e6ab5d9691be

  • SHA256

    5ecd777649462212355188b5ce8f26bb22673f7d280dfed8abcf055f4b819801

  • SHA512

    7cba4fb8b63e0156bb02574dd78a8b7b1d8e16a806fb228e6258b648fbf9dcc8ecadb945f55dbfe5a0f5006a0cc88ed03004e1067818161304374b5ced8aa012

  • SSDEEP

    1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOjFe:GhfxHNIreQm+Hi3

Score
10/10
qqpassdiscoverypersistencetrojan

Malware Config

Extracted

Family

qqpass

C2

http://www.zigui.org/article.php?id=103822

Attributes
  • url

    http://www.mxm9191.com/myrunner_up.exe

  • user_agent

    Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

Signatures

  • QQpass

    QQpass is a trojan written in C++..

    trojanqqpass
  • Qqpass family
    qqpass
  • Executes dropped EXE 1 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ecd777649462212355188b5ce8f26bb22673f7d280dfed8abcf055f4b819801.exe
    "C:\Users\Admin\AppData\Local\Temp\5ecd777649462212355188b5ce8f26bb22673f7d280dfed8abcf055f4b819801.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Windows\system\rundll32.exe
      C:\Windows\system\rundll32.exe
      2⤵
      • Executes dropped EXE
      • Modifies system executable filetype association
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\notepad¢¬.exe
    Filesize

    77KB

    MD5

    e3a42327e59e723bd97e5f201afdf29b

    SHA1

    de17ed5e98814e1af430a84503ae689429b378b8

    SHA256

    f943a57b630e371e2da0655e381916cedc6ad3d6a38390cf4e3d025247ccaf52

    SHA512

    ae2dfdad0ef3f18c26dced8d8f63ac8831d46a457d4fb8770642a68e0e534791d0284b6eb834800380d50b6bf6bb0e549fc5910d645d058fe5e0f6e5c3eb8e28

    Download Submit

  • C:\Windows\System\rundll32.exe
    Filesize

    80KB

    MD5

    7f256e80a559135638fcfa56a94c10e7

    SHA1

    a78f66f0a1d00d73542cb1b4850484b072107b0f

    SHA256

    5343dda8b2ac80523bf6a058077811b751dd312c02e847d511106e4cd9265595

    SHA512

    aa02b1fa07da2b98d3510ee35cb64803f12d30d0e6569a5079bfc3ee4f15f761c77ba0b12154af8ccad8eca94d39ade8d3ba6b28f088413873be3784e196fa8e

    Download Submit

  • memory/1172-0-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

    Download

  • memory/1172-13-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

    Download

  • memory/2136-14-0x0000000000400000-0x0000000000415A00-memory.dmp

    Filesize

    86KB

    Download