Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    162s
  • max time network
    99s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    30/09/2021, 03:04

General

  • Target

    4625fadd292dd4724204cea78edd13fd.exe

  • Size

    241KB

  • MD5

    4625fadd292dd4724204cea78edd13fd

  • SHA1

    9b9896fb6f66f1914e82ad984d5816403c8b5883

  • SHA256

    d9d7046f7539fd97259759a51b02650790a961ddb0d8f0b9f31c76faf6d63a91

  • SHA512

    ffaff488840a57bd5158b183b166b4c45683b7e8ef408b3d58b59619d8818602f5e7c1f1555c5fcdc7d9cc0c0f7c8aa15c012f8c4147dcfbbd84be84958a6381

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://fiskahlilian16.top/

http://paishancho17.top/

http://ydiannetter18.top/

http://azarehanelle19.top/

http://quericeriant20.top/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

Second BUILD

C2

asyndenera.xyz:15667

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4625fadd292dd4724204cea78edd13fd.exe
    "C:\Users\Admin\AppData\Local\Temp\4625fadd292dd4724204cea78edd13fd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:804
    • C:\Users\Admin\AppData\Local\Temp\4625fadd292dd4724204cea78edd13fd.exe
      "C:\Users\Admin\AppData\Local\Temp\4625fadd292dd4724204cea78edd13fd.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:996
  • C:\Users\Admin\AppData\Local\Temp\FCD9.exe
    C:\Users\Admin\AppData\Local\Temp\FCD9.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Users\Admin\AppData\Local\Temp\InternodesPiets_2021-09-29_21-00.exe
      "C:\Users\Admin\AppData\Local\Temp\InternodesPiets_2021-09-29_21-00.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:916
    • C:\Users\Admin\AppData\Local\Temp\Money10k_.exe
      "C:\Users\Admin\AppData\Local\Temp\Money10k_.exe"
      2⤵
      • Executes dropped EXE
      • Checks BIOS information in registry
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      PID:3420
  • C:\Users\Admin\AppData\Local\Temp\5E3.exe
    C:\Users\Admin\AppData\Local\Temp\5E3.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3304
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\5E3.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3112
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 10 /NOBREAK
        3⤵
        • Delays execution with timeout.exe
        PID:2204

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/744-121-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

    Filesize

    4KB

  • memory/804-114-0x0000000000030000-0x0000000000039000-memory.dmp

    Filesize

    36KB

  • memory/916-162-0x0000000005710000-0x0000000005711000-memory.dmp

    Filesize

    4KB

  • memory/916-151-0x00000000049A0000-0x00000000049A1000-memory.dmp

    Filesize

    4KB

  • memory/916-173-0x0000000007560000-0x0000000007561000-memory.dmp

    Filesize

    4KB

  • memory/916-145-0x0000000002040000-0x0000000002070000-memory.dmp

    Filesize

    192KB

  • memory/916-149-0x00000000023E0000-0x00000000023FF000-memory.dmp

    Filesize

    124KB

  • memory/916-148-0x0000000004990000-0x0000000004991000-memory.dmp

    Filesize

    4KB

  • memory/916-175-0x0000000005ED0000-0x0000000005ED1000-memory.dmp

    Filesize

    4KB

  • memory/916-161-0x0000000004994000-0x0000000004996000-memory.dmp

    Filesize

    8KB

  • memory/916-164-0x0000000006930000-0x0000000006931000-memory.dmp

    Filesize

    4KB

  • memory/916-158-0x0000000004992000-0x0000000004993000-memory.dmp

    Filesize

    4KB

  • memory/916-159-0x0000000004993000-0x0000000004994000-memory.dmp

    Filesize

    4KB

  • memory/916-156-0x0000000005690000-0x0000000005691000-memory.dmp

    Filesize

    4KB

  • memory/916-147-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/916-152-0x0000000004EA0000-0x0000000004EBE000-memory.dmp

    Filesize

    120KB

  • memory/996-115-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3056-192-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-203-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-217-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-216-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-214-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-215-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-212-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-213-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

    Filesize

    64KB

  • memory/3056-210-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-211-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-208-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-209-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-207-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

    Filesize

    64KB

  • memory/3056-206-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-204-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-205-0x0000000000FD0000-0x0000000000FE0000-memory.dmp

    Filesize

    64KB

  • memory/3056-180-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-179-0x00000000032D0000-0x00000000032E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-181-0x0000000003330000-0x0000000003340000-memory.dmp

    Filesize

    64KB

  • memory/3056-182-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-184-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-183-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-186-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-188-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-187-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-185-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-190-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-189-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-191-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-193-0x0000000003330000-0x0000000003340000-memory.dmp

    Filesize

    64KB

  • memory/3056-196-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-195-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-194-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-117-0x0000000000FA0000-0x0000000000FB5000-memory.dmp

    Filesize

    84KB

  • memory/3056-197-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-199-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-198-0x00000000032D0000-0x00000000032E0000-memory.dmp

    Filesize

    64KB

  • memory/3056-201-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-200-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3056-202-0x0000000003300000-0x0000000003310000-memory.dmp

    Filesize

    64KB

  • memory/3304-127-0x0000000000400000-0x00000000008AC000-memory.dmp

    Filesize

    4.7MB

  • memory/3304-126-0x0000000000C50000-0x0000000000CE0000-memory.dmp

    Filesize

    576KB

  • memory/3420-167-0x0000000007EE0000-0x0000000007EE1000-memory.dmp

    Filesize

    4KB

  • memory/3420-169-0x00000000079B0000-0x00000000079B1000-memory.dmp

    Filesize

    4KB

  • memory/3420-150-0x0000000006160000-0x0000000006161000-memory.dmp

    Filesize

    4KB

  • memory/3420-171-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

    Filesize

    4KB

  • memory/3420-178-0x0000000008A40000-0x0000000008A41000-memory.dmp

    Filesize

    4KB

  • memory/3420-160-0x0000000006040000-0x0000000006041000-memory.dmp

    Filesize

    4KB

  • memory/3420-141-0x0000000077240000-0x00000000773CE000-memory.dmp

    Filesize

    1.6MB

  • memory/3420-142-0x0000000000C10000-0x0000000000C11000-memory.dmp

    Filesize

    4KB

  • memory/3420-144-0x0000000006660000-0x0000000006661000-memory.dmp

    Filesize

    4KB

  • memory/3420-146-0x0000000005FF0000-0x0000000005FF1000-memory.dmp

    Filesize

    4KB