Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    112s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    08/07/2020, 06:53

General

  • Target

    Swift Copy #09765.exe

  • Size

    690KB

  • MD5

    f3b1bf9839a7f65a913e8298bb9ded82

  • SHA1

    c1b180b445500bbfbec473409683fb150afea3a2

  • SHA256

    ea9d8c28e623cbabc1407aa3da7a681adb93ef3e758fe31aaf664ff3998cddb5

  • SHA512

    ce230ee76f1cce30226df6a5f15e7f807638a7e356e44cc17bb60aac84630975b2ce516f129e8addb0483ae72be5991ab9c495f3f18be97a913a46b57dbfb0d4

Malware Config

Signatures

  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • System policy modification 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of WriteProcessMemory 20 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Adds Run entry to policy start application 2 TTPs 2 IoCs
  • Deletes itself 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Checks whether UAC is enabled
    • Suspicious use of SendNotifyMessage
    • Suspicious use of FindShellTrayWindow
    PID:1304
    • C:\Users\Admin\AppData\Local\Temp\Swift Copy #09765.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift Copy #09765.exe"
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      PID:1296
      • C:\Users\Admin\AppData\Local\Temp\Swift Copy #09765.exe
        "C:\Users\Admin\AppData\Local\Temp\Swift Copy #09765.exe"
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        PID:600
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Drops file in Program Files directory
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Adds Run entry to policy start application
      PID:1392
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy #09765.exe"
        3⤵
        • Deletes itself
        PID:1412
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:560

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/560-15-0x000000013F190000-0x000000013F223000-memory.dmp

      Filesize

      588KB

    • memory/600-0-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB

    • memory/1304-2-0x0000000006D50000-0x0000000006E0D000-memory.dmp

      Filesize

      756KB

    • memory/1392-4-0x0000000000500000-0x0000000000514000-memory.dmp

      Filesize

      80KB

    • memory/1392-13-0x0000000003510000-0x00000000035BF000-memory.dmp

      Filesize

      700KB

    • memory/1392-8-0x0000000074E20000-0x0000000074F3D000-memory.dmp

      Filesize

      1.1MB

    • memory/1392-7-0x0000000076890000-0x000000007689C000-memory.dmp

      Filesize

      48KB

    • memory/1392-6-0x00000000020A0000-0x000000000221F000-memory.dmp

      Filesize

      1.5MB