Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

5

9b92aae69e...cN.exe

windows7-x64

8

9b92aae69e...cN.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    120s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2024, 12:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9b92aae69e05af986818926585e9a6cb834aea767a32deb3f707d8e7b7c40a8cN.exe

  • Size

    484KB

  • MD5

    6c293e9084fc6c601eac168fff46fef0

  • SHA1

    17943ff8637a2e9cde913dbbf08d2d5f1955db4d

  • SHA256

    9b92aae69e05af986818926585e9a6cb834aea767a32deb3f707d8e7b7c40a8c

  • SHA512

    3564ea862113b5b4201a2ce52bbbcf8deb6754b87c9764d1b213aec4b7f5290e773fa82046d3738af569f65d39aeccab2af8c52b94089721a9701c0bba0eb738

  • SSDEEP

    6144:3F5GEy1w5zGiNbBvKI/tRCnFqrjoZK/GZWbE49fBDMhhoWtowWDGRIgVc5:37ryS5z//tRGFGEZK/G87Kewplg

Score
8/10
discoverypersistenceupx

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b92aae69e05af986818926585e9a6cb834aea767a32deb3f707d8e7b7c40a8cN.exe
    "C:\Users\Admin\AppData\Local\Temp\9b92aae69e05af986818926585e9a6cb834aea767a32deb3f707d8e7b7c40a8cN.exe"
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Users\Admin\AppData\Local\Temp\9b92aae69e05af986818926585e9a6cb834aea767a32deb3f707d8e7b7c40a8cN.exe
      "C:\Users\Admin\AppData\Local\Temp\9b92aae69e05af986818926585e9a6cb834aea767a32deb3f707d8e7b7c40a8cN.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Users\Admin\AppData\Local\Temp\9b92aae69e05af986818926585e9a6cb834aea767a32deb3f707d8e7b7c40a8cN.exe
        "C:\Users\Admin\AppData\Local\Temp\9b92aae69e05af986818926585e9a6cb834aea767a32deb3f707d8e7b7c40a8cN.exe"
        3⤵
          PID:4772
      • C:\Users\Admin\AppData\Local\Temp\9b92aae69e05af986818926585e9a6cb834aea767a32deb3f707d8e7b7c40a8cN.exe
        "C:\Users\Admin\AppData\Local\Temp\9b92aae69e05af986818926585e9a6cb834aea767a32deb3f707d8e7b7c40a8cN.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1376

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\cftmon.exe
      Filesize

      487KB

      MD5

      6c13c662e12830fce5147075989e06bf

      SHA1

      3974e1eb0fa7f33b7303043c2153fb8c0cc1df39

      SHA256

      a4134f82f9db57c713ea1c043612ec073d346b9fa35d776cdc8770a79703cfa0

      SHA512

      8898a7c81ded121348ffa3d0d14bba3b111b6767235e91c8c98ea46298352bae99d4647691bf4425728a1d2c94a1add9148671e4f1baf8c3eceb7fd8cba118a8

      Download Submit

    • C:\Windows\SysWOW64\msftp.dll
      Filesize

      5KB

      MD5

      11bf9bea80add82f873e4c31b9d28d2e

      SHA1

      1c2e0732fbbc97dcee9150380bfb63d2bf014e88

      SHA256

      1ff1089cd45af1f67601e86c77ae8c24cd632f44c7ef97b65676bbc5ed7212f5

      SHA512

      32ff380653d4b27cfc5baafa754b7edc22a59d412ab37635866c36f80bcad29404c9f8a395dcb7da900ecc72446dbe2491a54699afa711033afcbf087981be2d

      Download Submit

    • memory/1108-15-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1376-16-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/3428-0-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/3428-12-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/3428-13-0x0000000010000000-0x000000001010B000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/3428-14-0x0000000010000000-0x000000001010B000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4772-17-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download