Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09/07/2020, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
KSP QUOTE_2.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
KSP QUOTE_2.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
KSP QUOTE_2.exe
-
Size
527KB
-
MD5
187a269d103856e0d922e71e26046ac4
-
SHA1
3b9c201ceff06148739d6c59e3a20c2048e8a9fe
-
SHA256
48ce0e9cc96cb8d9ebe92bd7c1982e84d48baffdbada44d5949370a58ebae901
-
SHA512
9bedef76d5de703b32123c130aa27f0efd5850e395c2601ab030162872b5c06f68e1439282d9cef9a7133416ee23ed657f2da8f3d9e39ab5db39ad6c8c1ad66b
Score
8/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3848 KSP QUOTE_2.exe 3848 KSP QUOTE_2.exe 2728 KSP QUOTE_2.exe 2728 KSP QUOTE_2.exe 2728 KSP QUOTE_2.exe 2728 KSP QUOTE_2.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3848 set thread context of 2728 3848 KSP QUOTE_2.exe 75 PID 2728 set thread context of 2996 2728 KSP QUOTE_2.exe 56 PID 2872 set thread context of 2996 2872 explorer.exe 56 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer explorer.exe -
Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\N6G4MPYP = "C:\\Program Files (x86)\\Hibrxh0\\t8tplrlxjz7tan.exe" explorer.exe -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3848 wrote to memory of 2144 3848 KSP QUOTE_2.exe 72 PID 3848 wrote to memory of 2144 3848 KSP QUOTE_2.exe 72 PID 3848 wrote to memory of 2144 3848 KSP QUOTE_2.exe 72 PID 3848 wrote to memory of 2716 3848 KSP QUOTE_2.exe 74 PID 3848 wrote to memory of 2716 3848 KSP QUOTE_2.exe 74 PID 3848 wrote to memory of 2716 3848 KSP QUOTE_2.exe 74 PID 3848 wrote to memory of 2728 3848 KSP QUOTE_2.exe 75 PID 3848 wrote to memory of 2728 3848 KSP QUOTE_2.exe 75 PID 3848 wrote to memory of 2728 3848 KSP QUOTE_2.exe 75 PID 3848 wrote to memory of 2728 3848 KSP QUOTE_2.exe 75 PID 3848 wrote to memory of 2728 3848 KSP QUOTE_2.exe 75 PID 3848 wrote to memory of 2728 3848 KSP QUOTE_2.exe 75 PID 2996 wrote to memory of 2872 2996 Explorer.EXE 76 PID 2996 wrote to memory of 2872 2996 Explorer.EXE 76 PID 2996 wrote to memory of 2872 2996 Explorer.EXE 76 PID 2872 wrote to memory of 3724 2872 explorer.exe 77 PID 2872 wrote to memory of 3724 2872 explorer.exe 77 PID 2872 wrote to memory of 3724 2872 explorer.exe 77 PID 2872 wrote to memory of 3988 2872 explorer.exe 79 PID 2872 wrote to memory of 3988 2872 explorer.exe 79 PID 2872 wrote to memory of 3988 2872 explorer.exe 79 PID 2872 wrote to memory of 1020 2872 explorer.exe 81 PID 2872 wrote to memory of 1020 2872 explorer.exe 81 PID 2872 wrote to memory of 1020 2872 explorer.exe 81 -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 3848 KSP QUOTE_2.exe Token: SeDebugPrivilege 2728 KSP QUOTE_2.exe Token: SeDebugPrivilege 2872 explorer.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2728 KSP QUOTE_2.exe 2728 KSP QUOTE_2.exe 2728 KSP QUOTE_2.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe 2872 explorer.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Hibrxh0\t8tplrlxjz7tan.exe explorer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2144 schtasks.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\KSP QUOTE_2.exe"C:\Users\Admin\AppData\Local\Temp\KSP QUOTE_2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:3848 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OraVYaLSUiRqmq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5D39.tmp"3⤵
- Creates scheduled task(s)
PID:2144
-
-
C:\Users\Admin\AppData\Local\Temp\KSP QUOTE_2.exe"{path}"3⤵PID:2716
-
-
C:\Users\Admin\AppData\Local\Temp\KSP QUOTE_2.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:2728
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- System policy modification
- Adds Run entry to policy start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Drops file in Program Files directory
PID:2872 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\KSP QUOTE_2.exe"3⤵PID:3724
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3988
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:1020
-
-