Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2025, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
FixSfp.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
FixSfp.exe
Resource
win10v2004-20241007-en
General
-
Target
FixSfp.exe
-
Size
1.1MB
-
MD5
c4738b7ee108e1cfd0619cf740f458e0
-
SHA1
01c40a43bdf3bb2edfa4b9aa039439a47e9edc6d
-
SHA256
6ada7b6d8b6ddf3ebe61d3bf19e70bb5a2a9f22d871d217b1ade7c40c3aac088
-
SHA512
4c4a68739593e02c3997905ab10e7492b64f288a39211a81797cadaf2432aa90f94874e83520bbb149810e04fdc0e401eac30d10402b5c5822887f3b9cbbf2cb
-
SSDEEP
24576:xFdIR2uJMaFHaNfZq8gGl6kyhyjIVQGu7DTYHeNYiDXnYgU8:xko6MaFPE6kRjIVQG4Ds+aJm
Malware Config
Extracted
latrodectus
1.4
https://piloferstaf.com/test/
https://ypredoninen.com/test/
-
group
Sigma
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Signatures
-
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Deletes itself 1 IoCs
pid Process 5032 FixSfp.exe -
Executes dropped EXE 1 IoCs
pid Process 2204 Update_a16a60c9.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 5032 FixSfp.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5032 wrote to memory of 2204 5032 FixSfp.exe 82 PID 5032 wrote to memory of 2204 5032 FixSfp.exe 82 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FixSfp.exe"C:\Users\Admin\AppData\Local\Temp\FixSfp.exe"1⤵
- Deletes itself
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Roaming\Custom_update\Update_a16a60c9.exe"C:\Users\Admin\AppData\Roaming\Custom_update\Update_a16a60c9.exe"2⤵
- Executes dropped EXE
PID:2204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5c4738b7ee108e1cfd0619cf740f458e0
SHA101c40a43bdf3bb2edfa4b9aa039439a47e9edc6d
SHA2566ada7b6d8b6ddf3ebe61d3bf19e70bb5a2a9f22d871d217b1ade7c40c3aac088
SHA5124c4a68739593e02c3997905ab10e7492b64f288a39211a81797cadaf2432aa90f94874e83520bbb149810e04fdc0e401eac30d10402b5c5822887f3b9cbbf2cb