Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

1

PAYMENT FO...02.exe

windows7-x64

9

PAYMENT FO...02.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/02/2023, 07:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PAYMENT FOR INV-N102.exe

  • Size

    569KB

  • MD5

    be1645867fa6422fc02f52fd1a9b91e2

  • SHA1

    98673b3df49489e144da5f457515cfba84873b75

  • SHA256

    c4be26f16b500a69a26c344c7840ac5aee9fa4f32cca050924a848019ed29bbd

  • SHA512

    605e5db25959b15de67f7ce5a70c062258c0d17a0e7de932e488bad214b4c6b9b3c60e9219b36185df351baa469c100822c2a296ab8bc0a494950f00f1e9d911

  • SSDEEP

    12288:y8OG0deh2Q1IhJs3tm4lAy4Xpzzx9avGhctKr8z9i7+pvFCWtO:Zv07h+tmsTcpiv3Ar8zw6Rkh

Score
9/10
evasion

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\PAYMENT FOR INV-N102.exe
      "C:\Users\Admin\AppData\Local\Temp\PAYMENT FOR INV-N102.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Maps connected drives based on registry
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PAYMENT FOR INV-N102.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1744
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\pFQgzESg.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:764
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pFQgzESg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9DA7.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:1588
      • C:\Users\Admin\AppData\Local\Temp\PAYMENT FOR INV-N102.exe
        "C:\Users\Admin\AppData\Local\Temp\PAYMENT FOR INV-N102.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1936
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:704
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1624

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp9DA7.tmp
      Filesize

      1KB

      MD5

      f90e996c7f9dc700498a50beb24635c2

      SHA1

      7b0072a0a0adf2da59243bcd55b755c8c9971964

      SHA256

      286ea21761b1a1a66f9a088514bbe465d0c1f178d909c18b9c4baf2b40497aa1

      SHA512

      b0bd5adc06b8b40c99d28d49cedcb53d8d614ae6ca4dc12752fe0acd2c77d7740ce047ffe783d2451ac837813f0ba15a110eda1ea9b3a25a5b349e79d962e0cc

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      Filesize

      7KB

      MD5

      e36c69189487181bcdfb2c4705cfd2b1

      SHA1

      6f8e1894d962051169bd00791d6036a171cfdda1

      SHA256

      5bcb4f062e4bfd835f8d617f0bef014f8e704e2d725878df2e2c66d3a9cdbe88

      SHA512

      ffc911a22b5ac993d56a2e07df343ee239680f87c3f760e2ecae9d340d23632735a38378121d2228eac82400397fa101cd1dd0b4ecddeb720da8ef64f9e78a98

      Download Submit

    • \Users\Admin\AppData\Local\Temp\sqlite3.dll
      Filesize

      1.0MB

      MD5

      f1e5f58f9eb43ecec773acbdb410b888

      SHA1

      f1b8076b0bbde696694bbc0ab259a77893839464

      SHA256

      a15fd84ee61b54c92bb099dfb78226548f43d550c67fb6adf4cce3d064ab1c14

      SHA512

      0aff96430dd99bb227285fefc258014c301f85216c84e40f45702d26cdd7e77261a41fd3811d686f5fb2ee363cc651a014e8ffa339384004cece645a36486456

      Download Submit

    • memory/704-83-0x0000000000A30000-0x0000000000ABF000-memory.dmp

      Filesize

      572KB

      Download

    • memory/704-80-0x0000000000C10000-0x0000000000C17000-memory.dmp

      Filesize

      28KB

      Download

    • memory/704-81-0x0000000000080000-0x00000000000AD000-memory.dmp

      Filesize

      180KB

      Download

    • memory/704-82-0x0000000002020000-0x0000000002323000-memory.dmp

      Filesize

      3.0MB

      Download

    • memory/764-75-0x000000006ECB0000-0x000000006F25B000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1268-84-0x0000000006880000-0x000000000694B000-memory.dmp

      Filesize

      812KB

      Download

    • memory/1268-86-0x0000000006880000-0x000000000694B000-memory.dmp

      Filesize

      812KB

      Download

    • memory/1268-78-0x00000000072F0000-0x0000000007411000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/1412-66-0x0000000000D80000-0x0000000000DB6000-memory.dmp

      Filesize

      216KB

      Download

    • memory/1412-54-0x0000000001100000-0x0000000001192000-memory.dmp

      Filesize

      584KB

      Download

    • memory/1412-58-0x00000000052C0000-0x0000000005330000-memory.dmp

      Filesize

      448KB

      Download

    • memory/1412-57-0x0000000000280000-0x000000000028A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1412-56-0x0000000000250000-0x0000000000264000-memory.dmp

      Filesize

      80KB

      Download

    • memory/1412-55-0x0000000075771000-0x0000000075773000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1744-73-0x000000006ECB0000-0x000000006F25B000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/1936-77-0x0000000000260000-0x0000000000270000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1936-76-0x0000000000700000-0x0000000000A03000-memory.dmp

      Filesize

      3.0MB

      Download

    • memory/1936-74-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/1936-72-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/1936-70-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/1936-68-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

      Download

    • memory/1936-67-0x0000000000400000-0x000000000042F000-memory.dmp

      Filesize

      188KB

      Download