Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10_x64 -
resource
win10 -
submitted
08/07/2020, 10:28
Static task
static1
Behavioral task
behavioral1
Sample
July Approved Order_PDF.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
July Approved Order_PDF.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
July Approved Order_PDF.exe
-
Size
364KB
-
MD5
82fd63f045b5afd0834a9b1b579318fb
-
SHA1
7df3257d74c240f440c8ef001a414f6372a84724
-
SHA256
25e2619309515f2a7953682e8d4ea6d13b9c7030159aefbb8521d4316a58c19d
-
SHA512
7ea44d652f5ecfaafb141090aff32f3bc14b5c0acf2ad5457ebf4d7c1cc74aed8a16bda245b75fd105893c0a8deef9fff1555acf336adc7009106b6b3ff4cdd9
Score
8/10
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Xzzahpj\ThumbCacheoxgtrlh.exe msdt.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 4048 July Approved Order_PDF.exe Token: SeDebugPrivilege 3368 July Approved Order_PDF.exe Token: SeDebugPrivilege 3852 msdt.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 71 IoCs
pid Process 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 4048 July Approved Order_PDF.exe 3368 July Approved Order_PDF.exe 3368 July Approved Order_PDF.exe 3368 July Approved Order_PDF.exe 3368 July Approved Order_PDF.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4048 wrote to memory of 3892 4048 July Approved Order_PDF.exe 67 PID 4048 wrote to memory of 3892 4048 July Approved Order_PDF.exe 67 PID 4048 wrote to memory of 3892 4048 July Approved Order_PDF.exe 67 PID 4048 wrote to memory of 3368 4048 July Approved Order_PDF.exe 68 PID 4048 wrote to memory of 3368 4048 July Approved Order_PDF.exe 68 PID 4048 wrote to memory of 3368 4048 July Approved Order_PDF.exe 68 PID 4048 wrote to memory of 3368 4048 July Approved Order_PDF.exe 68 PID 4048 wrote to memory of 3368 4048 July Approved Order_PDF.exe 68 PID 4048 wrote to memory of 3368 4048 July Approved Order_PDF.exe 68 PID 2996 wrote to memory of 3852 2996 Explorer.EXE 69 PID 2996 wrote to memory of 3852 2996 Explorer.EXE 69 PID 2996 wrote to memory of 3852 2996 Explorer.EXE 69 PID 3852 wrote to memory of 3948 3852 msdt.exe 70 PID 3852 wrote to memory of 3948 3852 msdt.exe 70 PID 3852 wrote to memory of 3948 3852 msdt.exe 70 PID 3852 wrote to memory of 1912 3852 msdt.exe 78 PID 3852 wrote to memory of 1912 3852 msdt.exe 78 PID 3852 wrote to memory of 1912 3852 msdt.exe 78 PID 3852 wrote to memory of 2124 3852 msdt.exe 80 PID 3852 wrote to memory of 2124 3852 msdt.exe 80 -
Executes dropped EXE 2 IoCs
pid Process 3892 July Approved Order_PDF.exe 3368 July Approved Order_PDF.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4048 set thread context of 3368 4048 July Approved Order_PDF.exe 68 PID 3368 set thread context of 2996 3368 July Approved Order_PDF.exe 56 PID 3852 set thread context of 2996 3852 msdt.exe 56 -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3368 July Approved Order_PDF.exe 3368 July Approved Order_PDF.exe 3368 July Approved Order_PDF.exe 3852 msdt.exe 3852 msdt.exe 3852 msdt.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msdt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPMH6TWHUBUT = "C:\\Program Files (x86)\\Xzzahpj\\ThumbCacheoxgtrlh.exe" msdt.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"3⤵
- Executes dropped EXE
PID:3892
-
-
C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:3368
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Adds Run entry to start application
PID:3852 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\July Approved Order_PDF.exe"3⤵PID:3948
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1912
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:2124
-
-