Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2025, 17:57

General

  • Target

    FixSfp.exe

  • Size

    1.1MB

  • MD5

    c4738b7ee108e1cfd0619cf740f458e0

  • SHA1

    01c40a43bdf3bb2edfa4b9aa039439a47e9edc6d

  • SHA256

    6ada7b6d8b6ddf3ebe61d3bf19e70bb5a2a9f22d871d217b1ade7c40c3aac088

  • SHA512

    4c4a68739593e02c3997905ab10e7492b64f288a39211a81797cadaf2432aa90f94874e83520bbb149810e04fdc0e401eac30d10402b5c5822887f3b9cbbf2cb

  • SSDEEP

    24576:xFdIR2uJMaFHaNfZq8gGl6kyhyjIVQGu7DTYHeNYiDXnYgU8:xko6MaFPE6kRjIVQG4Ds+aJm

Score
10/10

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://piloferstaf.com/test/

https://ypredoninen.com/test/

Attributes
  • group

    Sigma

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Signatures

  • Latrodectus family
  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\FixSfp.exe
    "C:\Users\Admin\AppData\Local\Temp\FixSfp.exe"
    1⤵
    • Deletes itself
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Users\Admin\AppData\Roaming\Custom_update\Update_a16a60c9.exe
      "C:\Users\Admin\AppData\Roaming\Custom_update\Update_a16a60c9.exe"
      2⤵
      • Executes dropped EXE
      PID:2204

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Custom_update\Update_a16a60c9.exe

    Filesize

    1.1MB

    MD5

    c4738b7ee108e1cfd0619cf740f458e0

    SHA1

    01c40a43bdf3bb2edfa4b9aa039439a47e9edc6d

    SHA256

    6ada7b6d8b6ddf3ebe61d3bf19e70bb5a2a9f22d871d217b1ade7c40c3aac088

    SHA512

    4c4a68739593e02c3997905ab10e7492b64f288a39211a81797cadaf2432aa90f94874e83520bbb149810e04fdc0e401eac30d10402b5c5822887f3b9cbbf2cb

  • memory/2204-16-0x00007FF8A9FE0000-0x00007FF8A9FF0000-memory.dmp

    Filesize

    64KB

  • memory/2204-15-0x00007FF62F260000-0x00007FF62F270000-memory.dmp

    Filesize

    64KB

  • memory/5032-2-0x00007FF8E9FAA000-0x00007FF8E9FAB000-memory.dmp

    Filesize

    4KB

  • memory/5032-1-0x00007FF8A9FE0000-0x00007FF8A9FF0000-memory.dmp

    Filesize

    64KB

  • memory/5032-0-0x00007FF6B9240000-0x00007FF6B9250000-memory.dmp

    Filesize

    64KB

  • memory/5032-5-0x00007FF8E9F80000-0x00007FF8EA249000-memory.dmp

    Filesize

    2.8MB

  • memory/5032-3-0x0000000140000000-0x0000000141CB2000-memory.dmp

    Filesize

    28.7MB

  • memory/5032-17-0x00007FF8E9F80000-0x00007FF8EA249000-memory.dmp

    Filesize

    2.8MB

  • memory/5032-13-0x00007FF6F9200000-0x00007FF6F9321000-memory.dmp

    Filesize

    1.1MB