Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

Resubmissions

06/04/2021, 13:50

210406-gc51ndzsc2 10

26/03/2021, 23:40

210326-d1ybrjhevx 10

13/03/2021, 17:16

210313-8s7b52z63e 10

05/03/2021, 14:52

210305-34k3zj54f2 10

01/03/2021, 13:17

210301-naamxpgf4e 10

28/02/2021, 20:46

210228-6q3b959xae 10

28/02/2021, 20:15

210228-mbr268za12 10

28/02/2021, 18:32

210228-h944b5cpxa 10

28/02/2021, 15:10

210228-hnwwpyjy7j 10

Analysis

  • max time kernel
    266s
  • max time network
    292s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26/03/2021, 23:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe

  • Size

    9.2MB

  • MD5

    b806267b5f3b7760df56396b1cf05e6d

  • SHA1

    5166d4c1d3e476281d9e991eababc3e4aa9ec5ad

  • SHA256

    f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

  • SHA512

    30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Score
10/10
azorultplugxxmrigbootkitdiscoveryevasioninfostealermacrominerpersistencespywarestealertrojanupxxlm

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Nirsoft 4 IoCs
  • XMRig Miner Payload 4 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 20 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:728
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1108
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3556
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:1700
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:3604
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
          keygen-step-3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1436
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1996
            • C:\Windows\SysWOW64\PING.EXE
              ping 1.1.1.1 -n 1 -w 3000
              5⤵
              • Runs ping.exe
              PID:568
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1440
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3832
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
              5⤵
              • Enumerates connected drives
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:424
            • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
              C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp1
              5⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Checks SCSI registry key(s)
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3176
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:2980
              • C:\Users\Admin\AppData\Roaming\1616805439739.exe
                "C:\Users\Admin\AppData\Roaming\1616805439739.exe" /sjson "C:\Users\Admin\AppData\Roaming\1616805439739.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:4200
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:4620
              • C:\Users\Admin\AppData\Roaming\1616805442754.exe
                "C:\Users\Admin\AppData\Roaming\1616805442754.exe" /sjson "C:\Users\Admin\AppData\Roaming\1616805442754.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:4636
              • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3012
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                6⤵
                  PID:5012
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    7⤵
                    • Runs ping.exe
                    PID:5076
              • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
                C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp1
                5⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Writes to the Master Boot Record (MBR)
                • Checks SCSI registry key(s)
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2284
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c taskkill /f /im chrome.exe
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4072
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im chrome.exe
                    7⤵
                    • Kills process with taskkill
                    PID:3920
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                  6⤵
                    PID:4252
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      7⤵
                      • Runs ping.exe
                      PID:4416
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:184
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    6⤵
                    • Runs ping.exe
                    PID:2276
              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"
                4⤵
                • Executes dropped EXE
                PID:3888
              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                4⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                PID:2840
                • C:\Users\Admin\AppData\Roaming\9BC8.tmp.exe
                  "C:\Users\Admin\AppData\Roaming\9BC8.tmp.exe"
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of SetThreadContext
                  PID:1932
                  • C:\Windows\system32\msiexec.exe
                    -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                    6⤵
                      PID:4152
                    • C:\Windows\system32\msiexec.exe
                      -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
                      6⤵
                      • Blocklisted process makes network request
                      PID:4316
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                    5⤵
                      PID:4708
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1
                        6⤵
                        • Runs ping.exe
                        PID:4796
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                    4⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    PID:4740
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:3680
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:4132
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c taskkill /f /im chrome.exe
                      5⤵
                        PID:4520
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im chrome.exe
                          6⤵
                          • Kills process with taskkill
                          PID:4640
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
                      4⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      PID:4672
                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                        5⤵
                        • Executes dropped EXE
                        PID:4632
                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                        5⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4836
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Enumerates connected drives
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2716
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding CA05083A779D24ED33D926DEBD1341DC C
                  2⤵
                  • Loads dropped DLL
                  PID:3168
                • C:\Windows\system32\srtasks.exe
                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                  2⤵
                    PID:4884
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                    PID:4236
                  • \??\c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                    1⤵
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:4508

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/2284-65-0x0000000002D90000-0x0000000003239000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2284-37-0x0000000072220000-0x00000000722B3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/2840-55-0x0000000000370000-0x000000000037D000-memory.dmp

                    Filesize

                    52KB

                    Download

                  • memory/2840-75-0x0000000003480000-0x00000000034C4000-memory.dmp

                    Filesize

                    272KB

                    Download

                  • memory/2980-68-0x00007FF9B5FF0000-0x00007FF9B606E000-memory.dmp

                    Filesize

                    504KB

                    Download

                  • memory/2980-70-0x0000000010000000-0x0000000010057000-memory.dmp

                    Filesize

                    348KB

                    Download

                  • memory/2980-71-0x000002112B6D0000-0x000002112B6D1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3012-136-0x0000000072220000-0x00000000722B3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/3176-49-0x0000000010000000-0x000000001033E000-memory.dmp

                    Filesize

                    3.2MB

                    Download

                  • memory/3176-64-0x0000000003570000-0x0000000003A1F000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/3176-35-0x0000000072220000-0x00000000722B3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/3556-25-0x00000000024C0000-0x000000000265C000-memory.dmp

                    Filesize

                    1.6MB

                    Download

                  • memory/3680-114-0x00000000021C0000-0x00000000021C1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3680-109-0x00007FF99E6B0000-0x00007FF99F09C000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/3680-115-0x0000000002390000-0x0000000002392000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/3680-113-0x0000000002180000-0x00000000021B3000-memory.dmp

                    Filesize

                    204KB

                    Download

                  • memory/3680-112-0x0000000002170000-0x0000000002171000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3680-110-0x0000000000190000-0x0000000000191000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3832-28-0x0000000010000000-0x000000001033E000-memory.dmp

                    Filesize

                    3.2MB

                    Download

                  • memory/3832-24-0x0000000072220000-0x00000000722B3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/3888-46-0x00000000001D0000-0x00000000001D1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3888-43-0x00007FF99E6B0000-0x00007FF99F09C000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/3888-48-0x0000000002240000-0x0000000002242000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/4152-76-0x0000000140000000-0x0000000140383000-memory.dmp

                    Filesize

                    3.5MB

                    Download

                  • memory/4152-85-0x0000000140000000-0x0000000140383000-memory.dmp

                    Filesize

                    3.5MB

                    Download

                  • memory/4200-81-0x0000000072220000-0x00000000722B3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/4316-83-0x0000000140000000-0x000000014070A000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/4316-88-0x0000000140000000-0x000000014070A000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/4316-100-0x0000022B99880000-0x0000022B998A0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4316-147-0x0000022C2D4B0000-0x0000022C2D4D0000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4316-89-0x0000000140000000-0x000000014070A000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/4316-86-0x0000022B99740000-0x0000022B99754000-memory.dmp

                    Filesize

                    80KB

                    Download

                  • memory/4620-98-0x00000216237D0000-0x00000216237D1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4620-92-0x00007FF9B5FF0000-0x00007FF9B606E000-memory.dmp

                    Filesize

                    504KB

                    Download

                  • memory/4636-97-0x0000000072220000-0x00000000722B3000-memory.dmp

                    Filesize

                    588KB

                    Download