Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
46s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09/07/2020, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
RFQ Request For Quotation.doc. .exe
Resource
win7
Behavioral task
behavioral2
Sample
RFQ Request For Quotation.doc. .exe
Resource
win10v200430
General
-
Target
RFQ Request For Quotation.doc. .exe
-
Size
1.0MB
-
MD5
087a1ecc3d720b786d8cc8544bc469ed
-
SHA1
721623d6904a1c9e8168c3f104840490b5b52491
-
SHA256
dff0bf7c85f01cf94f21c7bdd224fe0b3d73dcad9cb38fa40eef4685c9bc63ab
-
SHA512
ae12605396dc568f7da9d9fdfb5518bcedea190c0c7f3d39d9773c76fee41bc5f0daf966ca31bba6acccdc5be867e64a30c6c1deed2425713db1226c196d5981
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1732 wrote to memory of 4088 1732 RFQ Request For Quotation.doc. .exe 68 PID 1732 wrote to memory of 4088 1732 RFQ Request For Quotation.doc. .exe 68 PID 1732 wrote to memory of 4088 1732 RFQ Request For Quotation.doc. .exe 68 PID 4088 wrote to memory of 2440 4088 WScript.exe 69 PID 4088 wrote to memory of 2440 4088 WScript.exe 69 PID 4088 wrote to memory of 2440 4088 WScript.exe 69 PID 2440 wrote to memory of 2576 2440 cmd.exe 71 PID 2440 wrote to memory of 2576 2440 cmd.exe 71 PID 2440 wrote to memory of 2576 2440 cmd.exe 71 PID 2576 wrote to memory of 2740 2576 net.exe 72 PID 2576 wrote to memory of 2740 2576 net.exe 72 PID 2576 wrote to memory of 2740 2576 net.exe 72 PID 2440 wrote to memory of 3716 2440 cmd.exe 73 PID 2440 wrote to memory of 3716 2440 cmd.exe 73 PID 2440 wrote to memory of 3716 2440 cmd.exe 73 PID 3716 wrote to memory of 3012 3716 WScript.exe 74 PID 3716 wrote to memory of 3012 3716 WScript.exe 74 PID 3716 wrote to memory of 3012 3716 WScript.exe 74 PID 3012 wrote to memory of 4068 3012 cmd.exe 76 PID 3012 wrote to memory of 4068 3012 cmd.exe 76 PID 3012 wrote to memory of 4068 3012 cmd.exe 76 PID 3012 wrote to memory of 3564 3012 cmd.exe 77 PID 3012 wrote to memory of 3564 3012 cmd.exe 77 PID 3012 wrote to memory of 3564 3012 cmd.exe 77 PID 3012 wrote to memory of 3752 3012 cmd.exe 78 PID 3012 wrote to memory of 3752 3012 cmd.exe 78 PID 3012 wrote to memory of 3752 3012 cmd.exe 78 -
Runs net.exe
-
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4068 attrib.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings RFQ Request For Quotation.doc. .exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ Request For Quotation.doc. .exe"C:\Users\Admin\AppData\Local\Temp\RFQ Request For Quotation.doc. .exe"1⤵
- Suspicious use of WriteProcessMemory
- Modifies registry class
PID:1732 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Local\Adobe\Pdf\low\Adobe.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Local\Adobe\Pdf\low\Adobe03.bat" /quiet /norestart"3⤵
- Suspicious use of WriteProcessMemory
- Modifies registry class
PID:2440 -
C:\Windows\SysWOW64\net.exeNET FILE4⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 FILE5⤵PID:2740
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Local\Adobe\Pdf\low\adobel.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Local\Adobe\Pdf\low\adobe01.bat" /quiet /norestart"5⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\attrib.exeattrib +r +a +s +h "C:\Users\Admin\AppData\Roaming\AdobeD\Adobe INC\AadobeRead\"6⤵
- Views/modifies file attributes
PID:4068
-
-
C:\Windows\SysWOW64\xcopy.exexcopy /y /h /e /r /k /c *.* "C:\Users\Admin\AppData\Roaming\AdobeD\Adobe Inc\AadobeRead\"6⤵
- Enumerates system info in registry
PID:3564
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\AdobeD\Adobe Inc\AadobeRead\adob02.bat"6⤵PID:3752
-
-
-
-
-