Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2023, 14:53
Static task
static1
Behavioral task
behavioral1
Sample
BankTransferForm.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
BankTransferForm.exe
Resource
win10v2004-20230220-en
General
-
Target
BankTransferForm.exe
-
Size
1.8MB
-
MD5
ff0a76b16c5a361efc8bcf2b93929cb5
-
SHA1
4382dae58d310e2a0017f67695ba35ab6f52ba52
-
SHA256
2c0fba171cec0f5ac33dcbc8e4795f5010e7b6a4e03ff8170e8154f2fd01df9a
-
SHA512
7338c36634dbedbfc4360789e9a3f28eee8eb3bae60b9eaa3ca50d04f61febdc0262f642c4d17d2166948546d866645652c450dbfcb193eaa81057b733df9bb1
-
SSDEEP
12288:47uix2TBXVnBGw4I/6QTdp7lRpIlfMer5iiTvdyPlIjCR8NMXzpUl3Gg4i3+u2Qc:56XMXzIr4hu2DHh
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\atg.exe," reg.exe -
Executes dropped EXE 1 IoCs
pid Process 4500 atg.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 4424 PING.EXE 3364 PING.EXE 3836 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe 744 BankTransferForm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 744 BankTransferForm.exe Token: SeDebugPrivilege 4500 atg.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 744 wrote to memory of 1772 744 BankTransferForm.exe 84 PID 744 wrote to memory of 1772 744 BankTransferForm.exe 84 PID 744 wrote to memory of 1772 744 BankTransferForm.exe 84 PID 1772 wrote to memory of 4424 1772 cmd.exe 86 PID 1772 wrote to memory of 4424 1772 cmd.exe 86 PID 1772 wrote to memory of 4424 1772 cmd.exe 86 PID 744 wrote to memory of 32 744 BankTransferForm.exe 88 PID 744 wrote to memory of 32 744 BankTransferForm.exe 88 PID 744 wrote to memory of 32 744 BankTransferForm.exe 88 PID 32 wrote to memory of 3364 32 cmd.exe 90 PID 32 wrote to memory of 3364 32 cmd.exe 90 PID 32 wrote to memory of 3364 32 cmd.exe 90 PID 1772 wrote to memory of 3408 1772 cmd.exe 91 PID 1772 wrote to memory of 3408 1772 cmd.exe 91 PID 1772 wrote to memory of 3408 1772 cmd.exe 91 PID 32 wrote to memory of 3836 32 cmd.exe 92 PID 32 wrote to memory of 3836 32 cmd.exe 92 PID 32 wrote to memory of 3836 32 cmd.exe 92 PID 32 wrote to memory of 4500 32 cmd.exe 100 PID 32 wrote to memory of 4500 32 cmd.exe 100 PID 32 wrote to memory of 4500 32 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\BankTransferForm.exe"C:\Users\Admin\AppData\Local\Temp\BankTransferForm.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\atg.exe,"2⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 383⤵
- Runs ping.exe
PID:4424
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\atg.exe,"3⤵
- Modifies WinLogon for persistence
PID:3408
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 45 > nul && copy "C:\Users\Admin\AppData\Local\Temp\BankTransferForm.exe" "C:\Users\Admin\AppData\Local\atg.exe" && ping 127.0.0.1 -n 45 > nul && "C:\Users\Admin\AppData\Local\atg.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 453⤵
- Runs ping.exe
PID:3364
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 453⤵
- Runs ping.exe
PID:3836
-
-
C:\Users\Admin\AppData\Local\atg.exe"C:\Users\Admin\AppData\Local\atg.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5ff0a76b16c5a361efc8bcf2b93929cb5
SHA14382dae58d310e2a0017f67695ba35ab6f52ba52
SHA2562c0fba171cec0f5ac33dcbc8e4795f5010e7b6a4e03ff8170e8154f2fd01df9a
SHA5127338c36634dbedbfc4360789e9a3f28eee8eb3bae60b9eaa3ca50d04f61febdc0262f642c4d17d2166948546d866645652c450dbfcb193eaa81057b733df9bb1
-
Filesize
1.8MB
MD5ff0a76b16c5a361efc8bcf2b93929cb5
SHA14382dae58d310e2a0017f67695ba35ab6f52ba52
SHA2562c0fba171cec0f5ac33dcbc8e4795f5010e7b6a4e03ff8170e8154f2fd01df9a
SHA5127338c36634dbedbfc4360789e9a3f28eee8eb3bae60b9eaa3ca50d04f61febdc0262f642c4d17d2166948546d866645652c450dbfcb193eaa81057b733df9bb1