Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    14/06/2021, 07:57

General

  • Target

    Folder.exe

  • Size

    876KB

  • MD5

    710ed49d2ea4c31614ec7167fc2dd67c

  • SHA1

    f5b961ce09e158c3c1d9531767ace98f3d173550

  • SHA256

    956afc0c6d10b544f71fee126a4fd36f91fb64c2ed86b73ea1b44dc57a7e2082

  • SHA512

    188480ca9dd4fab70f5b0142d03c0409365644794e3097a543bf4d29a122b7f3cc2ea2b59430e8aff5f36b264d027e3c0e71d07e89e7bc296cdaba2dde0e1e55

Score
10/10

Malware Config

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2704
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2436
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Modifies registry class
        PID:2420
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2260
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2240
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
          1⤵
            PID:1880
          • C:\Users\Admin\AppData\Local\Temp\Folder.exe
            "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
            1⤵
            • Checks computer location settings
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4068
            • C:\Windows\SysWOW64\rUNdlL32.eXe
              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
              2⤵
              • Loads dropped DLL
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2064
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1412
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1384
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1184
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1136
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                      PID:1040
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:1004
                      • \??\c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                        1⤵
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1828
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                          2⤵
                          • Drops file in System32 directory
                          • Checks processor information in registry
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3976

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/1004-132-0x000001986D340000-0x000001986D3B1000-memory.dmp

                        Filesize

                        452KB

                      • memory/1004-196-0x000001986DA40000-0x000001986DAB1000-memory.dmp

                        Filesize

                        452KB

                      • memory/1040-204-0x000002103AF10000-0x000002103AF81000-memory.dmp

                        Filesize

                        452KB

                      • memory/1040-164-0x000002103AE70000-0x000002103AEE1000-memory.dmp

                        Filesize

                        452KB

                      • memory/1136-148-0x000002097BC70000-0x000002097BCE1000-memory.dmp

                        Filesize

                        452KB

                      • memory/1136-202-0x000002097BD60000-0x000002097BDD1000-memory.dmp

                        Filesize

                        452KB

                      • memory/1184-210-0x000002756AF40000-0x000002756AFB1000-memory.dmp

                        Filesize

                        452KB

                      • memory/1184-170-0x000002756A980000-0x000002756A9F1000-memory.dmp

                        Filesize

                        452KB

                      • memory/1384-212-0x0000018544B30000-0x0000018544BA1000-memory.dmp

                        Filesize

                        452KB

                      • memory/1384-172-0x0000018544A40000-0x0000018544AB1000-memory.dmp

                        Filesize

                        452KB

                      • memory/1412-206-0x0000015A77820000-0x0000015A77891000-memory.dmp

                        Filesize

                        452KB

                      • memory/1412-166-0x0000015A777A0000-0x0000015A77811000-memory.dmp

                        Filesize

                        452KB

                      • memory/1828-119-0x000002564D800000-0x000002564D802000-memory.dmp

                        Filesize

                        8KB

                      • memory/1828-138-0x000002564D780000-0x000002564D7F1000-memory.dmp

                        Filesize

                        452KB

                      • memory/1880-208-0x0000028AA8810000-0x0000028AA8881000-memory.dmp

                        Filesize

                        452KB

                      • memory/1880-168-0x0000028AA8230000-0x0000028AA82A1000-memory.dmp

                        Filesize

                        452KB

                      • memory/2064-130-0x0000000004CF0000-0x0000000004D4C000-memory.dmp

                        Filesize

                        368KB

                      • memory/2064-122-0x0000000004BEE000-0x0000000004CEF000-memory.dmp

                        Filesize

                        1.0MB

                      • memory/2240-143-0x000001BCA83B0000-0x000001BCA8421000-memory.dmp

                        Filesize

                        452KB

                      • memory/2240-200-0x000001BCA8430000-0x000001BCA84A1000-memory.dmp

                        Filesize

                        452KB

                      • memory/2260-198-0x000001D0331C0000-0x000001D033231000-memory.dmp

                        Filesize

                        452KB

                      • memory/2260-137-0x000001D033140000-0x000001D0331B1000-memory.dmp

                        Filesize

                        452KB

                      • memory/2420-174-0x000002CB13240000-0x000002CB132B1000-memory.dmp

                        Filesize

                        452KB

                      • memory/2420-214-0x000002CB13670000-0x000002CB136E1000-memory.dmp

                        Filesize

                        452KB

                      • memory/2436-216-0x000001B2E9630000-0x000001B2E96A1000-memory.dmp

                        Filesize

                        452KB

                      • memory/2436-192-0x000001B2E88B0000-0x000001B2E88B2000-memory.dmp

                        Filesize

                        8KB

                      • memory/2436-176-0x000001B2E9200000-0x000001B2E9271000-memory.dmp

                        Filesize

                        452KB

                      • memory/2436-162-0x000001B2E88B0000-0x000001B2E88B2000-memory.dmp

                        Filesize

                        8KB

                      • memory/2704-194-0x0000025034220000-0x0000025034291000-memory.dmp

                        Filesize

                        452KB

                      • memory/2704-124-0x00000250341A0000-0x0000025034211000-memory.dmp

                        Filesize

                        452KB

                      • memory/3976-126-0x0000019261620000-0x000001926166B000-memory.dmp

                        Filesize

                        300KB

                      • memory/3976-146-0x00000192618D0000-0x0000019261941000-memory.dmp

                        Filesize

                        452KB

                      • memory/3976-180-0x0000019263130000-0x000001926314A000-memory.dmp

                        Filesize

                        104KB

                      • memory/3976-178-0x0000019263F00000-0x0000019264006000-memory.dmp

                        Filesize

                        1.0MB