Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2024, 16:55

General

  • Target

    4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe

  • Size

    3.1MB

  • MD5

    b236737a6d586c022e0bb342940b47c0

  • SHA1

    28cbd0876e7f5edfa11f155cf4aae43ea0514160

  • SHA256

    4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3a

  • SHA512

    4bf386b6dc2189e2b66109fa231c0b5214bcae697a3a3b62dac1d477158fb47738ec24cf8bc6ddca95fa315979ee3474088e83745cd9059decb02b23e78073a7

  • SSDEEP

    98304:c4x8xyqnWS3wiyiPMZBTZuU+EWnu55rBea:9gKSpyEMZNZuSPBea

Malware Config

Signatures

  • Floxif family
  • Floxif, Floodfix

    Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.

  • Detects Floxif payload 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe
    "C:\Users\Admin\AppData\Local\Temp\4959d96ea6fe3fbdeac76600bfdf9f3b64f36069529b4ceb031cbfa228193a3aN.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\3c2b8d0b89afc9104dc209eae7\Setup.exe
      C:\3c2b8d0b89afc9104dc209eae7\\Setup.exe /x86 /x64 /lcid 2052
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\3c2b8d0b89afc9104dc209eae7\1033\LocalizedData.xml

    Filesize

    75KB

    MD5

    326518603d85acd79a6258886fc85456

    SHA1

    f1cef14bc4671a132225d22a1385936ad9505348

    SHA256

    665797c7840b86379019e5a46227f888fa1a36a593ea41f9170ef018c337b577

    SHA512

    f8a514efd70e81d0f2f983282d69040bca6e42f29aa5df554e6874922a61f112e311ad5d2b719b6ca90012f69965447fb91e8cd4103efb2453ff160a9062e5d3

  • C:\3c2b8d0b89afc9104dc209eae7\2052\EULA.rtf

    Filesize

    5KB

    MD5

    4288c2541843f75c348d825fc8b94153

    SHA1

    e0dd8ed7bdb3c941a589361ee764f49a3619c264

    SHA256

    c30a7597aa67e2847940e2c24f09b35c07b1ec759adbca7c8261141fc1ecca92

    SHA512

    7ba9991fe4eed625fe7bef96a1d3ae70cb7616aad034236d1a2b346a08b48280cb6c20d2b059da9953919b0265125fe56dc5f4cc619ac653b4c1164ed564b359

  • C:\3c2b8d0b89afc9104dc209eae7\2052\LocalizedData.xml

    Filesize

    59KB

    MD5

    10da125eeabcbb45e0a272688b0e2151

    SHA1

    6c4124ec8ca2d03b5187ba567c922b6c3e5efc93

    SHA256

    1842f22c6fd4caf6ad217e331b74c6240b19991a82a1a030a6e57b1b8e9fd1ec

    SHA512

    d968abd74206a280f74bf6947757cca8dd9091b343203e5c2269af2e008d3bb0a17ff600eb961dbf69a93de4960133ade8d606fb9a99402d33b8889f2d0da710

  • C:\3c2b8d0b89afc9104dc209eae7\2052\SetupResources.dll

    Filesize

    13KB

    MD5

    bc3bc99d2b9db2ec02257514cf97109b

    SHA1

    8b2986cfa809b055a664f7fdbe9f54adf248cb4a

    SHA256

    edd482f8b218af997219123348f2012999d857872bc111d6ebc14fd1a39ec12b

    SHA512

    0cb60aa19d73f37bea7b7cfc03a8df712848aafc36a54eab52cb89625198e60864ca87d95540efdd85033e18b2472e4826aa6685d59a65120e4637e3c4fc2ddb

  • C:\3c2b8d0b89afc9104dc209eae7\DHTMLHeader.html

    Filesize

    15KB

    MD5

    cd131d41791a543cc6f6ed1ea5bd257c

    SHA1

    f42a2708a0b42a13530d26515274d1fcdbfe8490

    SHA256

    e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

    SHA512

    a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

  • C:\3c2b8d0b89afc9104dc209eae7\ParameterInfo.xml

    Filesize

    146KB

    MD5

    1e7ffa70bcd3d78d7b2f9c4ba0a93242

    SHA1

    c4b28df7b641869da780823bb8831de93494d169

    SHA256

    51dfb446ecc2d97ad8c7aa585d821f404b6c053dd2bed436d158cd99cb194a34

    SHA512

    6429ebf50602296435fd41135ea96b43dfa73a44034da4d012cfdab04537397e1a56357420d965f5f46af9c75adda6f1db6ec129b6b15fea842a5c41b7ae6c09

  • C:\3c2b8d0b89afc9104dc209eae7\SetupEngine.dll

    Filesize

    788KB

    MD5

    84c1daf5f30ff99895ecab3a55354bcf

    SHA1

    7e25ba36bcc7deed89f3c9568016ddb3156c9c5a

    SHA256

    7a0d281fa802d615ea1207bd2e9ebb98f3b74f9833bba3cb964ba7c7e0fb67fd

    SHA512

    e4fb7e4d39f094463fdcdc4895ab2ea500eb51a32b6909cec80a526bbf34d5c0eb98f47ee256c0f0865bf3169374937f047bf5c4d6762779c8ca3332b4103be3

  • C:\3c2b8d0b89afc9104dc209eae7\SetupUi.dll

    Filesize

    288KB

    MD5

    eb881e3dddc84b20bd92abcec444455f

    SHA1

    e2c32b1c86d4f70e39de65e9ebc4f361b24ff4a1

    SHA256

    11565d97287c01d22ad2e46c78d8a822fa3e6524561d4c02dfc87e8d346c44e7

    SHA512

    5750cec73b36a3f19bfb055f880f3b6498a7ae589017333f6272d26f1c72c6f475a3308826268a098372bbb096b43fbd1e06e93eecc0a81046668228bc179a75

  • C:\3c2b8d0b89afc9104dc209eae7\SetupUi.xsd

    Filesize

    29KB

    MD5

    2fadd9e618eff8175f2a6e8b95c0cacc

    SHA1

    9ab1710a217d15b192188b19467932d947b0a4f8

    SHA256

    222211e8f512edf97d78bc93e1f271c922d5e91fa899e092b4a096776a704093

    SHA512

    a3a934a8572ff9208d38cf381649bd83de227c44b735489fd2a9dc5a636ead9bb62459c9460ee53f61f0587a494877cd3a3c2611997be563f3137f8236ffc4ca

  • C:\3c2b8d0b89afc9104dc209eae7\SplashScreen.bmp

    Filesize

    40KB

    MD5

    0966fcd5a4ab0ddf71f46c01eff3cdd5

    SHA1

    8f4554f079edad23bcd1096e6501a61cf1f8ec34

    SHA256

    31c13ecfc0eb27f34036fb65cc0e735cd444eec75376eea2642f926ac162dcb3

    SHA512

    a9e70a2fb5a9899acf086474d71d0e180e2234c40e68bcadb9bf4fe145774680cb55584b39fe53cc75de445c6bf5741fc9b15b18385cbbe20fc595fe0ff86fce

  • C:\3c2b8d0b89afc9104dc209eae7\Strings.xml

    Filesize

    13KB

    MD5

    8a28b474f4849bee7354ba4c74087cea

    SHA1

    c17514dfc33dd14f57ff8660eb7b75af9b2b37b0

    SHA256

    2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b

    SHA512

    a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369

  • C:\3c2b8d0b89afc9104dc209eae7\UiInfo.xml

    Filesize

    38KB

    MD5

    002b52d8a030fb5bc2e35c9d209ecd41

    SHA1

    c4da0554a913a7a580c724d76ba2b1e13a598970

    SHA256

    44e7de36e58052f79d6168e867c9edee5bd6632d6f7450b55e94b1c666c4789e

    SHA512

    48a73976f797d3f83c722599e42135b550fe1f9479eede180403b2fda1c87da08e9176871f8ff017032a42046ac018eeb60c8e0b2c9fbc9e9f7a2d2f62cfb7da

  • C:\3c2b8d0b89afc9104dc209eae7\graphics\print.ico

    Filesize

    1KB

    MD5

    7e55ddc6d611176e697d01c90a1212cf

    SHA1

    e2620da05b8e4e2360da579a7be32c1b225deb1b

    SHA256

    ff542e32330b123486797b410621e19eafb39df3997e14701afa4c22096520ed

    SHA512

    283d381aa396820b7e15768b20099d67688da1f6315ec9f7938c2fcc3167777502cded0d1beddf015a34cc4e5d045bcb665ffd28ba2fbb6faf50fdd38b31d16e

  • C:\3c2b8d0b89afc9104dc209eae7\graphics\save.ico

    Filesize

    1KB

    MD5

    7d62e82d960a938c98da02b1d5201bd5

    SHA1

    194e96b0440bf8631887e5e9d3cc485f8e90fbf5

    SHA256

    ae041c8764f56fd89277b34982145d16fc59a4754d261c861b19371c3271c6e5

    SHA512

    ab06b2605f0c1f6b71ef69563c0c977d06c6ea84d58ef7f2baecba566d6037d1458c2b58e6bfd70ddef47dccbdea6d9c2f2e46dea67ea9e92457f754d7042f67

  • C:\3c2b8d0b89afc9104dc209eae7\graphics\setup.ico

    Filesize

    35KB

    MD5

    3d25d679e0ff0b8c94273dcd8b07049d

    SHA1

    a517fc5e96bc68a02a44093673ee7e076ad57308

    SHA256

    288e9ad8f0201e45bc187839f15aca79d6b9f76a7d3c9274c80f5d4a4c219c0f

    SHA512

    3bde668004ca7e28390862d0ae9903c756c16255bdbb3f7e73a5b093ce6a57a3165d6797b0a643b254493149231aca7f7f03e0af15a0cbe28aff02f0071ec255

  • C:\3c2b8d0b89afc9104dc209eae7\header.bmp

    Filesize

    3KB

    MD5

    514bfcd8da66722a9639eb41ed3988b7

    SHA1

    cf11618e3a3c790cd5239ee749a5ae513b4205cd

    SHA256

    6b8201ed10ce18ffade072b77c6d1fcaccf1d29acb47d86f553d9beebd991290

    SHA512

    89f01c3361ba874015325007ea24e83ae6e73700996d0912695a4e7cb3f8a611494ba9d63f004dcd4f358821e756be114bcf0137ed9b130776a6e26a95382c7b

  • C:\3c2b8d0b89afc9104dc209eae7\sqmapi.dll

    Filesize

    141KB

    MD5

    3f0363b40376047eff6a9b97d633b750

    SHA1

    4eaf6650eca5ce931ee771181b04263c536a948b

    SHA256

    bd6395a58f55a8b1f4063e813ce7438f695b9b086bb965d8ac44e7a97d35a93c

    SHA512

    537be86e2f171e0b2b9f462ac7f62c4342beb5d00b68451228f28677d26a525014758672466ad15ed1fd073be38142dae478df67718908eae9e6266359e1f9e8

  • C:\3c2b8d0b89afc9104dc209eae7\watermark.bmp

    Filesize

    101KB

    MD5

    b0075cee80173d764c0237e840ba5879

    SHA1

    b4cf45cd5bb036f4f210dfcba6ac16665a7c56a8

    SHA256

    ab18374b3aab10e5979e080d0410579f9771db888ba1b80a5d81ba8896e2d33a

    SHA512

    71a748c82cc8b0b42ef5a823bac4819d290da2eddbb042646682bccc7eb7ab320afdcfdfe08b1d9eebe149792b1259982e619f8e33845e33eec808c546e5c829

  • C:\Users\Admin\AppData\Local\Temp\A1D26E2\73D9430894.tmp

    Filesize

    3.0MB

    MD5

    aca1c250d44b47ad5c4c5ac039468eef

    SHA1

    67aa64e0e97597a9b17264b8ecaff40e18de5715

    SHA256

    87b2c7367e353b5ab2a6d4756a03fba7c75d58664f56b0ea36a331c299a1724d

    SHA512

    5ec7a4b5bb6d5b676649c3265b85d48a19ecab500319909448def6c390dca7b31cacb413e49be6ffb1cbdab157b1587d105dd2de29b4092ef18dea5057ce0cad

  • \3c2b8d0b89afc9104dc209eae7\Setup.exe

    Filesize

    76KB

    MD5

    006f8a615020a4a17f5e63801485df46

    SHA1

    78c82a80ebf9c8bf0c996dd8bc26087679f77fea

    SHA256

    d273460aa4d42f0b5764383e2ab852ab9af6fecb3ed866f1783869f2f155d8be

    SHA512

    c603ed6f3611eb7049a43a190ed223445a9f7bd5651100a825917198b50c70011e950fa968d3019439afa0a416752517b1c181ee9445e02da3904f4e4b73ce76

  • \3c2b8d0b89afc9104dc209eae7\SetupEngine.dll.tmp

    Filesize

    864KB

    MD5

    0d3ab03ae1010db8db5073eb4517f2c8

    SHA1

    2198038b627ae1a4e5fd2172e9faa93cc9436e0d

    SHA256

    ab7a875ea7c8cb3305617c991fa780b65f14a7de1c373afd0cd11f3384a943a4

    SHA512

    3bb28c1ff3014287826b86b470f5f26c8e8fcb9bb20289f30757d3ba1bf27774845553eb976187abd446f910ed1a51e36ae82fb384fcf1ea2bdfb58d388335c5

  • \Program Files\Common Files\System\symsrv.dll

    Filesize

    67KB

    MD5

    7574cf2c64f35161ab1292e2f532aabf

    SHA1

    14ba3fa927a06224dfe587014299e834def4644f

    SHA256

    de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

    SHA512

    4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

  • memory/2136-109-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2136-153-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2136-151-0x0000000074F30000-0x0000000074FF8000-memory.dmp

    Filesize

    800KB

  • memory/2196-3-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2196-186-0x0000000010000000-0x0000000010030000-memory.dmp

    Filesize

    192KB

  • memory/2196-184-0x00000000002A0000-0x00000000002D4000-memory.dmp

    Filesize

    208KB