Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    09/07/2020, 14:27

General

  • Target

    Mopigyo.exe

  • Size

    546KB

  • MD5

    790d5b40c6c93e4b5b404c61de360acc

  • SHA1

    a50f19294e5553b62f26792c43b5ee1d94efe04e

  • SHA256

    74d74e7da724014c17890327f3464b435314f480eb46553723ce0766941b38da

  • SHA512

    57bfba46ac49d674fd09332d055c9be45112dc53805e4e102f748a65b016cbc62459a7cebb257a993afb022eb9c35a33f68c5ebd4009c0979497626b4e7c6626

Score
8/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Adds Run entry to start application 2 TTPs 1 IoCs
  • Adds Run entry to policy start application 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    PID:3000
    • C:\Users\Admin\AppData\Local\Temp\Mopigyo.exe
      "C:\Users\Admin\AppData\Local\Temp\Mopigyo.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1460
      • C:\Program Files (x86)\internet explorer\ieinstal.exe
        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:968
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe"
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetThreadContext
      • Adds Run entry to start application
      • Adds Run entry to policy start application
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3860
      • C:\Windows\SysWOW64\cmd.exe
        /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
        3⤵
          PID:3936
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:3892

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1460-0-0x0000000010410000-0x000000001043D000-memory.dmp

        Filesize

        180KB

      • memory/3860-8-0x00000000062E0000-0x00000000063F9000-memory.dmp

        Filesize

        1.1MB

      • memory/3860-7-0x0000000006190000-0x000000000624E000-memory.dmp

        Filesize

        760KB

      • memory/3860-4-0x00000000003C0000-0x00000000003D3000-memory.dmp

        Filesize

        76KB

      • memory/3860-3-0x00000000003C0000-0x00000000003D3000-memory.dmp

        Filesize

        76KB

      • memory/3892-10-0x00007FF649C00000-0x00007FF649C93000-memory.dmp

        Filesize

        588KB

      • memory/3892-11-0x00007FF649C00000-0x00007FF649C93000-memory.dmp

        Filesize

        588KB

      • memory/3892-12-0x00007FF649C00000-0x00007FF649C93000-memory.dmp

        Filesize

        588KB