Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19/06/2022, 20:07
Static task
static1
Behavioral task
behavioral1
Sample
34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe
Resource
win10v2004-20220414-en
General
-
Target
34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe
-
Size
16KB
-
MD5
18d1e4e8df0412c61ff58f0b8ae6d95e
-
SHA1
35bc59db6c43aa866b812c8bb2e9b8038d5fe2fc
-
SHA256
34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af
-
SHA512
ad0309210430fb4085007f2b62a65594cf3becc437851c9bd863f90887c9bed8acc12c7e9449c6b1b476cda586ea62500d8f24e581eff8225b9ebab45b711c96
-
SSDEEP
384:1KBvkPHxH19GTXjdhYguujYcV6AUwJFZb:1YeRV9AhJfYcV6Dw9b
Malware Config
Extracted
loaderbot
http://user79869.7ci.ru/cmd.php
Signatures
-
LoaderBot executable 1 IoCs
resource yara_rule behavioral2/memory/4052-130-0x0000000000210000-0x000000000021A000-memory.dmp loaderbot -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe" 34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4136 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4052 34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4052 34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4052 34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4052 wrote to memory of 4276 4052 34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe 84 PID 4052 wrote to memory of 4276 4052 34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe 84 PID 4052 wrote to memory of 4276 4052 34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe 84 PID 4276 wrote to memory of 4136 4276 cmd.exe 86 PID 4276 wrote to memory of 4136 4276 cmd.exe 86 PID 4276 wrote to memory of 4136 4276 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe"C:\Users\Admin\AppData\Local\Temp\34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\34c36c75c6d89b31460963832d2fc0ac50fa2e6c291b94d7e25aec245d0d43af.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:4136
-
-