Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07/07/2020, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
payment invoice.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
payment invoice.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
payment invoice.exe
-
Size
179KB
-
MD5
3b2135422ad7974f674d9e3afffa04e7
-
SHA1
e8a7ab8aea4ba52a5af377e4e77c983d9be2db7a
-
SHA256
a361c3ef57783d4012857a289d088c19682187bb0b6f15eabb73865d1d54e180
-
SHA512
c708e169d34d54fa0fb104d553b967c7748ab31602c622c96f880916af36d53a493e6aeef55b9e6aa0e4450487b1089c85af037fb6fb9af73936e05931f2e3c6
Score
10/10
Malware Config
Signatures
-
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\-ZYLYRXH = "C:\\Program Files (x86)\\Bez7\\rrzkdxdj.exe" msiexec.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 2804 payment invoice.exe 2804 payment invoice.exe 2804 payment invoice.exe 2804 payment invoice.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2804 payment invoice.exe Token: SeDebugPrivilege 1276 msiexec.exe Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE Token: SeShutdownPrivilege 2984 Explorer.EXE Token: SeCreatePagefilePrivilege 2984 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2804 payment invoice.exe 2804 payment invoice.exe 2804 payment invoice.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe 1276 msiexec.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2804 set thread context of 2984 2804 payment invoice.exe 56 PID 1276 set thread context of 2984 1276 msiexec.exe 56 -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2984 wrote to memory of 1276 2984 Explorer.EXE 68 PID 2984 wrote to memory of 1276 2984 Explorer.EXE 68 PID 2984 wrote to memory of 1276 2984 Explorer.EXE 68 PID 1276 wrote to memory of 1600 1276 msiexec.exe 69 PID 1276 wrote to memory of 1600 1276 msiexec.exe 69 PID 1276 wrote to memory of 1600 1276 msiexec.exe 69 PID 1276 wrote to memory of 3888 1276 msiexec.exe 75 PID 1276 wrote to memory of 3888 1276 msiexec.exe 75 PID 1276 wrote to memory of 3888 1276 msiexec.exe 75 PID 1276 wrote to memory of 3840 1276 msiexec.exe 77 PID 1276 wrote to memory of 3840 1276 msiexec.exe 77 PID 1276 wrote to memory of 3840 1276 msiexec.exe 77 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Bez7\rrzkdxdj.exe msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\payment invoice.exe"C:\Users\Admin\AppData\Local\Temp\payment invoice.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2804
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Adds Run entry to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Drops file in Program Files directory
PID:1276 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\payment invoice.exe"3⤵PID:1600
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3888
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:3840
-
-