Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2023, 08:27

General

  • Target

    May New Order.rtf

  • Size

    34KB

  • MD5

    b94ab0ff3e9e9f20e322a7571fcf041f

  • SHA1

    4b2cdbfb38262df6976f0ce23c8e5aa8a002e5a5

  • SHA256

    f24781001f198ec760cdf8805dc1fb123558d60d32e0cefbffe0a410f0519838

  • SHA512

    be1bbd1b09eef6e22c8f94294664d163ddc2874d2765ad0375615c202be669411432702dbff383ca403d2ad56d07ec2feb094f84f4e718a3e08897eb789e1bdb

  • SSDEEP

    768:lFx0XaIsnPRIa4fwJMTMIzsycs/2biGJyYlEFud:lf0Xvx3EMAIrcs/aJVkud

Malware Config

Extracted

Family

lokibot

C2

http://185.246.220.60/govonor/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\May New Order.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1724
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Users\Admin\AppData\Roaming\govonoroy475289.exe
        "C:\Users\Admin\AppData\Roaming\govonoroy475289.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:876
        • C:\Users\Admin\AppData\Roaming\govonoroy475289.exe
          "C:\Users\Admin\AppData\Roaming\govonoroy475289.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious use of AdjustPrivilegeToken
          • outlook_office_path
          • outlook_win_path
          PID:1976

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      17f45305100d48ce5ab277195f460070

      SHA1

      a3ece46d799c9c3410e922d7ff3513bb19d92acd

      SHA256

      f8950b5f980e363133122a8b610f144b32a21397a5b3d6f2a61e2ce0abee6caf

      SHA512

      9a422370281a3931cf34c7979568a64f03ea0cf59e7bb5017befe4b9a51b000318f2cf9358d4904d447ce3eefb59226929c5e6eaa46e69fcaf9aa22029b08de1

    • C:\Users\Admin\AppData\Roaming\govonoroy475289.exe

      Filesize

      480KB

      MD5

      a6f2dc75cad48b19e2c49eb872f759de

      SHA1

      581ffa7a871d7c7e760834d5cf3558e82b8289a1

      SHA256

      45ecfd36d97932c3c4fb1548684eaa696d4288cb373d95bae9010e057291611b

      SHA512

      d1de431ac9341b7caa077a37613601c58c8bc43c8eecebe3645bb3e94fff728004fd54083542a810d31798bb000c14ad467fb19c92ee9e5819ca6e5d92dce3fb

    • C:\Users\Admin\AppData\Roaming\govonoroy475289.exe

      Filesize

      480KB

      MD5

      a6f2dc75cad48b19e2c49eb872f759de

      SHA1

      581ffa7a871d7c7e760834d5cf3558e82b8289a1

      SHA256

      45ecfd36d97932c3c4fb1548684eaa696d4288cb373d95bae9010e057291611b

      SHA512

      d1de431ac9341b7caa077a37613601c58c8bc43c8eecebe3645bb3e94fff728004fd54083542a810d31798bb000c14ad467fb19c92ee9e5819ca6e5d92dce3fb

    • C:\Users\Admin\AppData\Roaming\govonoroy475289.exe

      Filesize

      480KB

      MD5

      a6f2dc75cad48b19e2c49eb872f759de

      SHA1

      581ffa7a871d7c7e760834d5cf3558e82b8289a1

      SHA256

      45ecfd36d97932c3c4fb1548684eaa696d4288cb373d95bae9010e057291611b

      SHA512

      d1de431ac9341b7caa077a37613601c58c8bc43c8eecebe3645bb3e94fff728004fd54083542a810d31798bb000c14ad467fb19c92ee9e5819ca6e5d92dce3fb

    • C:\Users\Admin\AppData\Roaming\govonoroy475289.exe

      Filesize

      480KB

      MD5

      a6f2dc75cad48b19e2c49eb872f759de

      SHA1

      581ffa7a871d7c7e760834d5cf3558e82b8289a1

      SHA256

      45ecfd36d97932c3c4fb1548684eaa696d4288cb373d95bae9010e057291611b

      SHA512

      d1de431ac9341b7caa077a37613601c58c8bc43c8eecebe3645bb3e94fff728004fd54083542a810d31798bb000c14ad467fb19c92ee9e5819ca6e5d92dce3fb

    • \Users\Admin\AppData\Roaming\govonoroy475289.exe

      Filesize

      480KB

      MD5

      a6f2dc75cad48b19e2c49eb872f759de

      SHA1

      581ffa7a871d7c7e760834d5cf3558e82b8289a1

      SHA256

      45ecfd36d97932c3c4fb1548684eaa696d4288cb373d95bae9010e057291611b

      SHA512

      d1de431ac9341b7caa077a37613601c58c8bc43c8eecebe3645bb3e94fff728004fd54083542a810d31798bb000c14ad467fb19c92ee9e5819ca6e5d92dce3fb

    • \Users\Admin\AppData\Roaming\govonoroy475289.exe

      Filesize

      480KB

      MD5

      a6f2dc75cad48b19e2c49eb872f759de

      SHA1

      581ffa7a871d7c7e760834d5cf3558e82b8289a1

      SHA256

      45ecfd36d97932c3c4fb1548684eaa696d4288cb373d95bae9010e057291611b

      SHA512

      d1de431ac9341b7caa077a37613601c58c8bc43c8eecebe3645bb3e94fff728004fd54083542a810d31798bb000c14ad467fb19c92ee9e5819ca6e5d92dce3fb

    • memory/832-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/832-118-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/876-81-0x0000000000A40000-0x0000000000A62000-memory.dmp

      Filesize

      136KB

    • memory/876-79-0x0000000000710000-0x000000000071A000-memory.dmp

      Filesize

      40KB

    • memory/876-80-0x0000000004F20000-0x0000000004F7A000-memory.dmp

      Filesize

      360KB

    • memory/876-77-0x0000000004830000-0x0000000004870000-memory.dmp

      Filesize

      256KB

    • memory/876-70-0x00000000012D0000-0x000000000134E000-memory.dmp

      Filesize

      504KB

    • memory/876-75-0x0000000004830000-0x0000000004870000-memory.dmp

      Filesize

      256KB

    • memory/876-76-0x00000000004E0000-0x00000000004EC000-memory.dmp

      Filesize

      48KB

    • memory/1976-87-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1976-85-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/1976-86-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/1976-88-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/1976-84-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/1976-91-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/1976-92-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/1976-97-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/1976-83-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB

    • memory/1976-82-0x0000000000400000-0x00000000004A2000-memory.dmp

      Filesize

      648KB