Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20/05/2023, 14:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BankTransferForm.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
BankTransferForm.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
BankTransferForm.exe
-
Size
1.8MB
-
MD5
ff0a76b16c5a361efc8bcf2b93929cb5
-
SHA1
4382dae58d310e2a0017f67695ba35ab6f52ba52
-
SHA256
2c0fba171cec0f5ac33dcbc8e4795f5010e7b6a4e03ff8170e8154f2fd01df9a
-
SHA512
7338c36634dbedbfc4360789e9a3f28eee8eb3bae60b9eaa3ca50d04f61febdc0262f642c4d17d2166948546d866645652c450dbfcb193eaa81057b733df9bb1
-
SSDEEP
12288:47uix2TBXVnBGw4I/6QTdp7lRpIlfMer5iiTvdyPlIjCR8NMXzpUl3Gg4i3+u2Qc:56XMXzIr4hu2DHh
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\atg.exe," reg.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 1872 PING.EXE 1232 PING.EXE 1648 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe 1304 BankTransferForm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1304 BankTransferForm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1304 wrote to memory of 672 1304 BankTransferForm.exe 28 PID 1304 wrote to memory of 672 1304 BankTransferForm.exe 28 PID 1304 wrote to memory of 672 1304 BankTransferForm.exe 28 PID 1304 wrote to memory of 672 1304 BankTransferForm.exe 28 PID 672 wrote to memory of 1872 672 cmd.exe 30 PID 672 wrote to memory of 1872 672 cmd.exe 30 PID 672 wrote to memory of 1872 672 cmd.exe 30 PID 672 wrote to memory of 1872 672 cmd.exe 30 PID 1304 wrote to memory of 1988 1304 BankTransferForm.exe 31 PID 1304 wrote to memory of 1988 1304 BankTransferForm.exe 31 PID 1304 wrote to memory of 1988 1304 BankTransferForm.exe 31 PID 1304 wrote to memory of 1988 1304 BankTransferForm.exe 31 PID 1988 wrote to memory of 1232 1988 cmd.exe 33 PID 1988 wrote to memory of 1232 1988 cmd.exe 33 PID 1988 wrote to memory of 1232 1988 cmd.exe 33 PID 1988 wrote to memory of 1232 1988 cmd.exe 33 PID 672 wrote to memory of 572 672 cmd.exe 34 PID 672 wrote to memory of 572 672 cmd.exe 34 PID 672 wrote to memory of 572 672 cmd.exe 34 PID 672 wrote to memory of 572 672 cmd.exe 34 PID 1988 wrote to memory of 1648 1988 cmd.exe 35 PID 1988 wrote to memory of 1648 1988 cmd.exe 35 PID 1988 wrote to memory of 1648 1988 cmd.exe 35 PID 1988 wrote to memory of 1648 1988 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\BankTransferForm.exe"C:\Users\Admin\AppData\Local\Temp\BankTransferForm.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 36 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\atg.exe,"2⤵
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 363⤵
- Runs ping.exe
PID:1872
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\atg.exe,"3⤵
- Modifies WinLogon for persistence
PID:572
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 48 > nul && copy "C:\Users\Admin\AppData\Local\Temp\BankTransferForm.exe" "C:\Users\Admin\AppData\Local\atg.exe" && ping 127.0.0.1 -n 48 > nul && "C:\Users\Admin\AppData\Local\atg.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 483⤵
- Runs ping.exe
PID:1232
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 483⤵
- Runs ping.exe
PID:1648
-
-