Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe
Resource
win10v2004-20240802-en
General
-
Target
f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe
-
Size
77KB
-
MD5
54b4c3a3141e09c22d94af07f1a089b0
-
SHA1
6c5848e1d34e401e5f0fd063a5ba47779c810db8
-
SHA256
f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fc
-
SHA512
bf7937e6dd2219b388f6c2011dc1342b824b2adfe21cb411ea8a355f573e1be42673e5a1b1853edf0e24b506af0963c63071a9de63b69cb19b0549c7acc9dee4
-
SSDEEP
1536:2gsYOmp0JMmIbLSjj6mDniX12LtWwfi+TjRC/D:2ej4hniWYwf1TjYD
Malware Config
Extracted
berbew
http://crutop.nu/index.php
http://crutop.ru/index.php
http://mazafaka.ru/index.php
http://color-bank.ru/index.php
http://asechka.ru/index.php
http://trojan.ru/index.php
http://fuck.ru/index.php
http://goldensand.ru/index.php
http://filesearch.ru/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://lovingod.host.sk/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://mazafaka.ru/index.htm
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
http://fethard.biz/index.htm
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Fjocbhbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Fjocbhbo.exe -
Executes dropped EXE 2 IoCs
pid Process 1280 Fjocbhbo.exe 2344 Gddgpqbe.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\Fjocbhbo.exe f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe File opened for modification C:\Windows\SysWOW64\Fjocbhbo.exe f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe File created C:\Windows\SysWOW64\Fohoiloe.dll f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe File created C:\Windows\SysWOW64\Gddgpqbe.exe Fjocbhbo.exe File opened for modification C:\Windows\SysWOW64\Gddgpqbe.exe Fjocbhbo.exe File created C:\Windows\SysWOW64\Jcggmk32.dll Fjocbhbo.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4748 2344 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fjocbhbo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gddgpqbe.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fohoiloe.dll" f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcggmk32.dll" Fjocbhbo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Fjocbhbo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Fjocbhbo.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3656 wrote to memory of 1280 3656 f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe 89 PID 3656 wrote to memory of 1280 3656 f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe 89 PID 3656 wrote to memory of 1280 3656 f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe 89 PID 1280 wrote to memory of 2344 1280 Fjocbhbo.exe 90 PID 1280 wrote to memory of 2344 1280 Fjocbhbo.exe 90 PID 1280 wrote to memory of 2344 1280 Fjocbhbo.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe"C:\Users\Admin\AppData\Local\Temp\f6247cc753c56ba31fd6e887b6dedb456eec838ac23cee2cde877e5c63cd12fcN.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\SysWOW64\Fjocbhbo.exeC:\Windows\system32\Fjocbhbo.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\Gddgpqbe.exeC:\Windows\system32\Gddgpqbe.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 4004⤵
- Program crash
PID:4748
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2344 -ip 23441⤵PID:3172
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:81⤵PID:1564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD51951e5d1a8098feb1dabd4e9835b4e55
SHA100be4171ef5fa983deaa4747efd63c9eb7a25415
SHA2566491ba82f3c612254eacef5410c462695425e901aab914c9a936df17271da6b2
SHA5123e832849da24cb64c9880a55cffa3a0d90d50ab4332e333e1b7e1dd0cba23e135e195c3066dc152324c99eb1579afe082e51dd28c300858ad1b1c422cdbbe70a
-
Filesize
77KB
MD56046c29d673f9541f6326f2e3ab06b4f
SHA19e45888c91e5717f4789ad30aaa424d101f1a6e0
SHA25686b0043cc0f5928100c3bba44b2c4843cf6026e1f36e17785ac9b8a66c0bc8f6
SHA512369382aa9f75bace70bac6ff72a7b5167552945b30355c3aae3d0ace0cd171e8ea58aca43d13b4a78c09ea9c23aff8dfb05e19a0e95c7803a2d49ec80b757b09