Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/08/2021, 11:34

210805-3hmtrhklp2 10

05/08/2021, 11:29

210805-8ee9f9c312 1

Analysis

  • max time kernel
    148s
  • max time network
    195s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    05/08/2021, 11:34

General

  • Target

    AcroRd32DQe.bin.exe

  • Size

    293KB

  • MD5

    187a89cf24890c3af628219d0d9ae881

  • SHA1

    5b1ba0821ca5461ced123cc646dd5823504075f5

  • SHA256

    f949b78b040cbfc95aafb50ef30ac3e8c16771c6b926b6f8f1efe44a1f437d51

  • SHA512

    aaf9203cda730018988f38c4734b144d0f83e61e3a342c6c26f3668b2e6860d95558da39bc11d3a7d4683f74059e144fc0c98ebe05acde501012caf3609263ef

Malware Config

Extracted

Family

plugx

C2

45.134.83.41:443

45.134.83.41:8080

45.134.83.41:80

Mutex

jqcdxvOfUAlRGUCUknxZ

Attributes
  • folder

    AcroRd32DQe

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AcroRd32DQe.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\AcroRd32DQe.bin.exe"
    1⤵
    • Loads dropped DLL
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Users\Admin\AppData\Local\Temp\AcroRd32.exe
      "C:\Users\Admin\AppData\Local\Temp\AcroRd32.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:320
      • C:\ProgramData\AcroRd32DQe\AcroRd32.exe
        C:\ProgramData\AcroRd32DQe\AcroRd32.exe 444
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:576
        • C:\ProgramData\back\acrotrays.exe
          C:\ProgramData\back\acrotrays.exe -d AAA
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1640

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/320-78-0x0000000000A50000-0x0000000000B50000-memory.dmp

    Filesize

    1024KB

  • memory/320-68-0x0000000002410000-0x0000000006049000-memory.dmp

    Filesize

    60.2MB

  • memory/576-77-0x0000000001F20000-0x0000000005B59000-memory.dmp

    Filesize

    60.2MB

  • memory/1640-87-0x0000000001EB0000-0x0000000005AE9000-memory.dmp

    Filesize

    60.2MB

  • memory/1824-60-0x0000000075631000-0x0000000075633000-memory.dmp

    Filesize

    8KB