Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
13/07/2020, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
STATEMENT OF ACCOUNT.exe
-
Size
332KB
-
MD5
ee68d3b0f702077810bddec50179f75d
-
SHA1
e84957da433e6df765486f71391edf69f882f50a
-
SHA256
ee3971f3a905a7bd6126d3d02e0ecaa71bbe41136d3faa0680eec42a4cf20af9
-
SHA512
957eeeef26c139874fc7983078872b491f534ccc447f98d920ac43d11df7b36ffd3cfa1519fb178d6d103a04237b31f4cd5523cedbea778095a93fc0343cebe4
Score
10/10
Malware Config
Signatures
-
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wscript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wscript.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 416 RegAsm.exe 416 RegAsm.exe 416 RegAsm.exe 416 RegAsm.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
pid Process 3656 STATEMENT OF ACCOUNT.exe 3656 STATEMENT OF ACCOUNT.exe 416 RegAsm.exe 416 RegAsm.exe 416 RegAsm.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe 512 wscript.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3656 set thread context of 416 3656 STATEMENT OF ACCOUNT.exe 67 PID 416 set thread context of 3012 416 RegAsm.exe 56 PID 512 set thread context of 3012 512 wscript.exe 56 -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 416 RegAsm.exe Token: SeDebugPrivilege 512 wscript.exe Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE Token: SeShutdownPrivilege 3012 Explorer.EXE Token: SeCreatePagefilePrivilege 3012 Explorer.EXE -
Adds Run entry to policy start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JHD01NEPFNY = "C:\\Program Files (x86)\\Lktghm\\userblbxn6kx.exe" wscript.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe STATEMENT OF ACCOUNT.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lktghm\userblbxn6kx.exe wscript.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3656 wrote to memory of 3664 3656 STATEMENT OF ACCOUNT.exe 66 PID 3656 wrote to memory of 3664 3656 STATEMENT OF ACCOUNT.exe 66 PID 3656 wrote to memory of 3664 3656 STATEMENT OF ACCOUNT.exe 66 PID 3656 wrote to memory of 416 3656 STATEMENT OF ACCOUNT.exe 67 PID 3656 wrote to memory of 416 3656 STATEMENT OF ACCOUNT.exe 67 PID 3656 wrote to memory of 416 3656 STATEMENT OF ACCOUNT.exe 67 PID 3656 wrote to memory of 416 3656 STATEMENT OF ACCOUNT.exe 67 PID 3012 wrote to memory of 512 3012 Explorer.EXE 68 PID 3012 wrote to memory of 512 3012 Explorer.EXE 68 PID 3012 wrote to memory of 512 3012 Explorer.EXE 68 PID 512 wrote to memory of 656 512 wscript.exe 69 PID 512 wrote to memory of 656 512 wscript.exe 69 PID 512 wrote to memory of 656 512 wscript.exe 69 PID 512 wrote to memory of 3668 512 wscript.exe 77 PID 512 wrote to memory of 3668 512 wscript.exe 77 PID 512 wrote to memory of 3668 512 wscript.exe 77 PID 512 wrote to memory of 4004 512 wscript.exe 79 PID 512 wrote to memory of 4004 512 wscript.exe 79 PID 512 wrote to memory of 4004 512 wscript.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3664
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:416
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Modifies Internet Explorer settings
- System policy modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to policy start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:656
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3668
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4004
-
-