Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

22/05/2023, 08:09

230522-j15zbahf9x 7

08/05/2023, 11:01

230508-m4jf9sac65 7

Analysis

  • max time kernel
    109s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    22/05/2023, 08:09

General

  • Target

    verybigchimpanzee.exe

  • Size

    344KB

  • MD5

    aec814bf30dd191b641feef457a718ce

  • SHA1

    96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

  • SHA256

    446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

  • SHA512

    fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

  • SSDEEP

    6144:SXRrO+JguvyIs1DkhmgPZw6JXAL5+9bbYZQ4:ir/9m3cYZQ

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\verybigchimpanzee.exe
    "C:\Users\Admin\AppData\Local\Temp\verybigchimpanzee.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:828
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "verybigchimpanzee" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\verybigchimpanzee.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:1324
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:1492
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "verybigchimpanzee" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:792
        • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe
          "C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:1480
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 1480 -s 2976
            4⤵
            • Program crash
            PID:1080
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {71E1C4CC-DF5F-488B-8D97-2BCAA05B8538} S-1-5-21-2961826002-3968192592-354541192-1000:HVMHZIYD\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe
        C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1944
      • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe
        C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:556

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      adc4ec792d60999690c101a11fca3969

      SHA1

      28c95320e836a43b0ed35f0bc463363e2ee06384

      SHA256

      d7f24971782f1729a9030191cd5a031693b1e23cf06b7cabc4d403788b6a17a9

      SHA512

      13158e35aca246b48d8187717d3f8a08ebbf5dd0ab6658854f017ac96fb11daf39e12ebe62e69b3fedd4394552552ea303f0fe6e44e7888599c68c909f82c3b4

    • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe

      Filesize

      344KB

      MD5

      aec814bf30dd191b641feef457a718ce

      SHA1

      96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

      SHA256

      446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

      SHA512

      fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

    • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe

      Filesize

      344KB

      MD5

      aec814bf30dd191b641feef457a718ce

      SHA1

      96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

      SHA256

      446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

      SHA512

      fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

    • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe

      Filesize

      344KB

      MD5

      aec814bf30dd191b641feef457a718ce

      SHA1

      96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

      SHA256

      446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

      SHA512

      fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

    • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe

      Filesize

      344KB

      MD5

      aec814bf30dd191b641feef457a718ce

      SHA1

      96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

      SHA256

      446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

      SHA512

      fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

    • C:\Users\Admin\AppData\Local\Temp\Cab29D2.tmp

      Filesize

      61KB

      MD5

      fc4666cbca561e864e7fdf883a9e6661

      SHA1

      2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

      SHA256

      10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

      SHA512

      c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

    • C:\Users\Admin\AppData\Local\Temp\Cab2D3E.tmp

      Filesize

      62KB

      MD5

      3ac860860707baaf32469fa7cc7c0192

      SHA1

      c33c2acdaba0e6fa41fd2f00f186804722477639

      SHA256

      d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

      SHA512

      d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    • C:\Users\Admin\AppData\Local\Temp\Tar2ED9.tmp

      Filesize

      164KB

      MD5

      4ff65ad929cd9a367680e0e5b1c08166

      SHA1

      c0af0d4396bd1f15c45f39d3b849ba444233b3a2

      SHA256

      c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

      SHA512

      f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

    • memory/828-54-0x0000000000CD0000-0x0000000000D2C000-memory.dmp

      Filesize

      368KB

    • memory/828-57-0x000000001B260000-0x000000001B2E0000-memory.dmp

      Filesize

      512KB

    • memory/1480-63-0x0000000000660000-0x00000000006E0000-memory.dmp

      Filesize

      512KB

    • memory/1480-61-0x00000000002C0000-0x000000000031C000-memory.dmp

      Filesize

      368KB

    • memory/1480-146-0x0000000000660000-0x00000000006E0000-memory.dmp

      Filesize

      512KB