Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

FYCC new o...21.exe

windows7-x64

8

FYCC new o...21.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 18:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FYCC new order S460013746-560121121.exe

  • Size

    920KB

  • MD5

    78eff09f295aa4b3aaf36af5245efe94

  • SHA1

    dea545e8b85f2c1201f7aa3a54f643826ca8a6ed

  • SHA256

    38f275624c634801c164c2c8f3294cbeea49b47e8e8d83bda53a0bc8aa7f7106

  • SHA512

    a8b49247156aa7004206f24211054f7f37c73df06e8a85ecf843e9c44cc99a5cf29886e85ba03d89a87a1d3968322c25cdef7877ae6c5efcfa946910204ce67f

  • SSDEEP

    12288:T3TEG/N9AKPGu+MAyn6+6Slh5/2qVe2lR8XaZW4IaBAP7r9r/+ppppppppppppp7:8AnAPRo6+pPOnoR8X2W4JBA1q

Score
8/10
discoveryexecution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe
    "C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2180
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zriEHRxkd.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2740
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zriEHRxkd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC60D.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2876
    • C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe
      "C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe"
      2⤵
        PID:2956
      • C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe
        "C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe"
        2⤵
          PID:2836
        • C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe
          "C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe"
          2⤵
            PID:2344
          • C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe
            "C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe"
            2⤵
              PID:2748
            • C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe
              "C:\Users\Admin\AppData\Local\Temp\FYCC new order S460013746-560121121.exe"
              2⤵
                PID:2660

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpC60D.tmp
              Filesize

              1KB

              MD5

              02544faa5c0cb9be9d917caecc9498da

              SHA1

              11db0d15ef89af6fb044d35f14b815bdaf2525e5

              SHA256

              980b770982cbcacf0ec0cfd65c63819b4d1c3789a60efb67b9234e2c805abb69

              SHA512

              0800f404b8e8fec1c6b7c4ff18d2f6af074fbaac39fee3046d13b2b4ffd85a9d6b43689d8829b6f6ad3db53c75b8fbe8bc1418026df82a32834d3dd343b71161

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
              Filesize

              7KB

              MD5

              76b3e235fca5126c4bbe05f7a6d29860

              SHA1

              24e0b5901fb5ba820bbcc05b7badb28764c04fc8

              SHA256

              818e5ba80e97cccf05198ea6e8e2b4669efbe54ceb700a99efbf0a290d5fc2a5

              SHA512

              2cb097024ebb6dada73f3ccd474c9022f3c74f8eeaa060ea84b97de6b91f08f5000608ed4b030de551761d720cb2c1a9d735bc57caf12f79fe2842ee2ff9aa59

              Download Submit

            • memory/2572-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2572-1-0x0000000000390000-0x000000000047C000-memory.dmp

              Filesize

              944KB

              Download

            • memory/2572-2-0x0000000074C10000-0x00000000752FE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2572-3-0x0000000000630000-0x000000000064E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/2572-4-0x0000000074C1E000-0x0000000074C1F000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2572-5-0x0000000074C10000-0x00000000752FE000-memory.dmp

              Filesize

              6.9MB

              Download

            • memory/2572-6-0x0000000001D90000-0x0000000001E12000-memory.dmp

              Filesize

              520KB

              Download

            • memory/2572-19-0x0000000074C10000-0x00000000752FE000-memory.dmp

              Filesize

              6.9MB

              Download