Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 18:01
Static task
static1
Behavioral task
behavioral1
Sample
c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe
Resource
win7-20220812-en
General
-
Target
c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe
-
Size
81KB
-
MD5
ab1094bc750e9ee2604b4c69d4b27099
-
SHA1
2093c3b4232929ee355cef027f02b8fa56475c17
-
SHA256
c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe
-
SHA512
4929580a82a8d6b3c11d9578788291953cc196b856c29f2069d33b9ab5bf96b4111701cfb41c3e2a7fdc5b32f847cfb84b0f23e5ba457f0cb1bb835ca0682481
-
SSDEEP
1536:6aH1w5TZVN7ciGKTFmLq6d7b/PjuYgFIPV6KFTf3iimaHUavfvV:V1qrd3TFmGo/LuYGIdnfd2un
Malware Config
Extracted
pony
http://dreststat.info:2346/pony/mac.php
http://dertystat.info:2346/pony/mac.php
-
payload_url
http://dertystat.info:2346/pony/view/kos.exe
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\test c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe -
resource yara_rule behavioral1/memory/1344-57-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1344-58-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1344-66-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 948 cmd.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\7249756 = "cmd.exe /c copy C:\\Users\\Admin\\AppData\\Local\\Temp\\7242159FdOh C:\\Windows\\system32\\drivers\\etc\\hosts /Y && attrib +H C:\\Windows\\system32\\drivers\\etc\\hosts /f" reg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeTcbPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeChangeNotifyPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeCreateTokenPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeBackupPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeRestorePrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeIncreaseQuotaPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeAssignPrimaryTokenPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeImpersonatePrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeTcbPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeChangeNotifyPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeCreateTokenPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeBackupPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeRestorePrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeIncreaseQuotaPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeAssignPrimaryTokenPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeImpersonatePrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeTcbPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeChangeNotifyPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeCreateTokenPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeBackupPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeRestorePrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeIncreaseQuotaPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeAssignPrimaryTokenPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeImpersonatePrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeTcbPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeChangeNotifyPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeCreateTokenPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeBackupPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeRestorePrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeIncreaseQuotaPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe Token: SeAssignPrimaryTokenPrivilege 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1344 wrote to memory of 940 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 26 PID 1344 wrote to memory of 940 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 26 PID 1344 wrote to memory of 940 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 26 PID 1344 wrote to memory of 940 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 26 PID 1344 wrote to memory of 980 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 28 PID 1344 wrote to memory of 980 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 28 PID 1344 wrote to memory of 980 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 28 PID 1344 wrote to memory of 980 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 28 PID 980 wrote to memory of 752 980 cmd.exe 30 PID 980 wrote to memory of 752 980 cmd.exe 30 PID 980 wrote to memory of 752 980 cmd.exe 30 PID 980 wrote to memory of 752 980 cmd.exe 30 PID 940 wrote to memory of 468 940 cmd.exe 31 PID 940 wrote to memory of 468 940 cmd.exe 31 PID 940 wrote to memory of 468 940 cmd.exe 31 PID 940 wrote to memory of 468 940 cmd.exe 31 PID 1344 wrote to memory of 948 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 32 PID 1344 wrote to memory of 948 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 32 PID 1344 wrote to memory of 948 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 32 PID 1344 wrote to memory of 948 1344 c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe"C:\Users\Admin\AppData\Local\Temp\c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c at 01:39:00 cmd.exe /c copy %TEMP%\7242159FdOh %WINDIR%\system32\drivers\etc\hosts /Y && rename %WINDIR%\system32\drivers\etc\hosts hosts.sys2⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\at.exeat 01:39:00 cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\7242159FdOh C:\Windows\system32\drivers\etc\hosts /Y3⤵PID:468
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\CurrentVersion\Run /v 7249756 /t REG_SZ /d "cmd.exe /c copy %TEMP%\7242159FdOh %WINDIR%\system32\drivers\etc\hosts /Y && attrib +H %WINDIR%\system32\drivers\etc\hosts /f2⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\reg.exereg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\CurrentVersion\Run /v 7249756 /t REG_SZ /d "cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\7242159FdOh C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts /f3⤵
- Adds Run key to start application
PID:752
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\abcd.bat" "C:\Users\Admin\AppData\Local\Temp\c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe" "2⤵
- Deletes itself
PID:948
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75B
MD50849cfe65b98ba5fcd9a9ec61a671d09
SHA19d0ccb383c32b1bc07fd9064b9324a18e1276902
SHA25644f6a1e48081deccfb61075e585bcb36c6d8e8feeb6ebae50bab41677822c643
SHA512afdeda8122b4cefcf7549018c40d3142985e88a6d8f13eb58e9a59aa312b73608123de5f9feebc2ce25b6ec215d23c324b9f3a9a0e97041d67d863a25e15e57a