Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    97s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 02:41

General

  • Target

    e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe

  • Size

    54KB

  • MD5

    2a3fb18c680d1db507969f93ad76b726

  • SHA1

    9a60bb7131f93e94274ffbfb722f4b53b906d6b1

  • SHA256

    e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803

  • SHA512

    d59c90e640e45e326096581b935a018f2f007607ac1c27471c723c39cbf7c314e11442c7cba34bf3635dcb6c8a8d8d6a76e5b5a68c5670e5104b1960f38bf344

  • SSDEEP

    768:6rpGUKbGPJfS/A+0jmlZ8veI+2qYg7ZffFLCNnbcuyD7U7R:6Hq/ADjmlZ8GITMdL2nouy87R

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Stops running service(s) 3 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe
    "C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Program Files (x86)\DGT.hta"
      2⤵
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      PID:1656
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c taskkill /im coiome.exe /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im coiome.exe /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1072
    • C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe
      "C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c sc delete JavaServe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Windows\SysWOW64\sc.exe
          sc delete JavaServe
          4⤵
          • Launches sc.exe
          PID:2008
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c attrib -h -s -r -a "%userprofile%\Cookies\*.*"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h -s -r -a "C:\Users\Admin\Cookies\*.*"
          4⤵
          • Views/modifies file attributes
          PID:1076
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c attrib -h -s -r -a "%userprofile%\Local Settings\Temp\Cookies\*.*"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1116
        • C:\Windows\SysWOW64\attrib.exe
          attrib -h -s -r -a "C:\Users\Admin\Local Settings\Temp\Cookies\*.*"
          4⤵
          • Views/modifies file attributes
          PID:1804
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c del /f /s /q "%userprofile%\Cookies\*.*
        3⤵
          PID:1228
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c del /f /s /q "%userprofile%\Local Settings\Temporary Internet Files\*.*"
          3⤵
            PID:1032
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c del /f /s /q "%userprofile%\Local Settings\Temp\Cookies\*.*"
            3⤵
              PID:1972
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c del "C:\Users\Admin\AppData\Local\Temp\e681a43247029144495d250e65a4fdc9fd037d6730db0d3af0ac3f19efc46803.exe"
            2⤵
            • Deletes itself
            PID:560

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Common Files\sfbsbvx\coiome.exe

          Filesize

          12.1MB

          MD5

          c17abe22a67cde15e056ff1e6b4e548e

          SHA1

          f56bb568c36003722c5d1955efb6c0ef38db758a

          SHA256

          b1aacad0b4f3b6ca2ba68385d5a2578893bb3404dbd3c31a938765b4180ea71b

          SHA512

          3e8e761f91af1797ba462f2de705ee1f5975bb8e4680a6b76567f27e42f758429b358045cb875ca475060218937582c3679802ca506e4bb15ee0ee1a67a2c1d9

        • C:\Program Files (x86)\DGT.hta

          Filesize

          780B

          MD5

          cfae0efb683986503bb789616bad8b55

          SHA1

          9325f503e9c4d97a7d06d81859f73d245a974753

          SHA256

          8f1076023a3e05a05e9938b08398e885a516f7442a19cd0de7fd3a87f6c0ccd8

          SHA512

          e338c41006f670cc98554f1c3a262cc7e4d9dd680bd9d77cc2b5a048a7f3b630f59df6a02fe6542df71647ce3eb7541f86bc3266fad396a9859620a7d26a942c

        • \Program Files (x86)\Common Files\sfbsbvx\coiome.exe

          Filesize

          12.1MB

          MD5

          c17abe22a67cde15e056ff1e6b4e548e

          SHA1

          f56bb568c36003722c5d1955efb6c0ef38db758a

          SHA256

          b1aacad0b4f3b6ca2ba68385d5a2578893bb3404dbd3c31a938765b4180ea71b

          SHA512

          3e8e761f91af1797ba462f2de705ee1f5975bb8e4680a6b76567f27e42f758429b358045cb875ca475060218937582c3679802ca506e4bb15ee0ee1a67a2c1d9

        • \Program Files (x86)\Common Files\sfbsbvx\coiome.exe

          Filesize

          12.1MB

          MD5

          c17abe22a67cde15e056ff1e6b4e548e

          SHA1

          f56bb568c36003722c5d1955efb6c0ef38db758a

          SHA256

          b1aacad0b4f3b6ca2ba68385d5a2578893bb3404dbd3c31a938765b4180ea71b

          SHA512

          3e8e761f91af1797ba462f2de705ee1f5975bb8e4680a6b76567f27e42f758429b358045cb875ca475060218937582c3679802ca506e4bb15ee0ee1a67a2c1d9

        • memory/868-67-0x00000000002D0000-0x00000000002DF000-memory.dmp

          Filesize

          60KB

        • memory/868-55-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

        • memory/868-61-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

        • memory/868-68-0x00000000002D0000-0x00000000002DF000-memory.dmp

          Filesize

          60KB

        • memory/868-54-0x00000000753D1000-0x00000000753D3000-memory.dmp

          Filesize

          8KB

        • memory/1692-71-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

        • memory/1692-69-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB