Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

22/05/2023, 08:09

230522-j15zbahf9x 7

08/05/2023, 11:01

230508-m4jf9sac65 7

Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/05/2023, 08:09

General

  • Target

    verybigchimpanzee.exe

  • Size

    344KB

  • MD5

    aec814bf30dd191b641feef457a718ce

  • SHA1

    96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

  • SHA256

    446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

  • SHA512

    fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

  • SSDEEP

    6144:SXRrO+JguvyIs1DkhmgPZw6JXAL5+9bbYZQ4:ir/9m3cYZQ

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\verybigchimpanzee.exe
    "C:\Users\Admin\AppData\Local\Temp\verybigchimpanzee.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "verybigchimpanzee" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\verybigchimpanzee.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4920
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:220
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:3712
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "verybigchimpanzee" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:1728
        • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe
          "C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:1512
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmpCD67.tmp" -C "C:\Users\Admin\AppData\Local\8lxyt4fm8n"
            4⤵
              PID:4584
            • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
              "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:696
      • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe
        C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3712
        • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
          "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:880
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3712 -s 2416
          2⤵
          • Program crash
          PID:4836
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 208 -p 3712 -ip 3712
        1⤵
          PID:2704
        • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe
          C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2428
          • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe
            "C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:400
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 2428 -s 2076
            2⤵
            • Program crash
            PID:1396
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 504 -p 2428 -ip 2428
          1⤵
            PID:3408

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\8lxyt4fm8n\data\cached-microdesc-consensus.tmp

            Filesize

            2.2MB

            MD5

            b757486e4404779d260e2ee9027ae5bd

            SHA1

            efaa1a33e922de62a0d40ef76e7099fc1ef2eda9

            SHA256

            44f77036d6cda7db1020a94fda8756c7b1e75bba60def355d66e327914a77b8c

            SHA512

            3a95565bdac1bb0c8b6631caff20803b82eed227cb9c5e35f74ef7a7897dee9751e522aebcb6183fa30ed774000943a82acccb7ab6db9fdc948799691ae75655

          • C:\Users\Admin\AppData\Local\8lxyt4fm8n\data\cached-microdescs.new

            Filesize

            6.2MB

            MD5

            1cb9a82c35de574cfcd32dbb96758586

            SHA1

            90f965f9828a15e5db6a58f5c8069bfed0a12da9

            SHA256

            3e5fd4918273263b314e59f12b0e8c934b39a62f01f39fa2554e5e85c281d8ce

            SHA512

            d02f8245cb9caa008c6b1a5be04e0bbb89283461695cb918b2d4be35e5d2ddd72aa965e183353a6689f0d40068b2367036e565a0678d42a35f9985257bdd6b2e

          • C:\Users\Admin\AppData\Local\8lxyt4fm8n\host\hostname

            Filesize

            64B

            MD5

            6781cc334b60130f13cee43c7f9302f1

            SHA1

            2572bbe01d34c62044141a17370e4a97ade7e7b1

            SHA256

            36e6574ea90b3d59f3949af56cdf307169b3513fe38dc6fe1d8d54cb2f16f2ee

            SHA512

            fc934232d91bf6fd223cd8e95b56aca5a12c0907cd5d67c6e8b02284b4ac956d1256d6c2aaca84cd42fe5f98f73875051fee9e59155c74ecba4d20b22e5c2752

          • C:\Users\Admin\AppData\Local\8lxyt4fm8n\port.dat

            Filesize

            4B

            MD5

            575425a3f433138553be468c9d1ecba7

            SHA1

            6bae87122ce00b61e523513e1d3d0e1c1c5a67dc

            SHA256

            70252984654c35f9f8f37247ae126116e93be2f3acf82061cf06981916e8f828

            SHA512

            305db70f83681d1639ea48aa140a72c0106b0b447c3ad89d9d684350858b1cbe3f7b9b0a1e6266f043a53da7bc688544c096ffa33dc8ebbe071db70162410553

          • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe

            Filesize

            7.4MB

            MD5

            88590909765350c0d70c6c34b1f31dd2

            SHA1

            129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

            SHA256

            46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

            SHA512

            a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

          • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe

            Filesize

            7.4MB

            MD5

            88590909765350c0d70c6c34b1f31dd2

            SHA1

            129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

            SHA256

            46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

            SHA512

            a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

          • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe

            Filesize

            7.4MB

            MD5

            88590909765350c0d70c6c34b1f31dd2

            SHA1

            129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

            SHA256

            46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

            SHA512

            a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

          • C:\Users\Admin\AppData\Local\8lxyt4fm8n\tor\tor.exe

            Filesize

            7.4MB

            MD5

            88590909765350c0d70c6c34b1f31dd2

            SHA1

            129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

            SHA256

            46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

            SHA512

            a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

          • C:\Users\Admin\AppData\Local\8lxyt4fm8n\torrc.txt

            Filesize

            218B

            MD5

            1489a83d38845245ad8671f6ed9b841f

            SHA1

            51584ee8e6a2c32a7bbbaf8190401b15ff4cb6f3

            SHA256

            ffab7a8029aa1206172df8020d6639b5344a6c4926c1c18471d18ee9e62a5482

            SHA512

            3ee4c9db8011336aa642937c144d1f728871c3b359f6d07fbaec0a8c28f1320c4977f6c02777b6454486de8fd8367e0e4b2bb4fec29249aa8a239faad44ebb0c

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\verybigchimpanzee.exe.log

            Filesize

            847B

            MD5

            3308a84a40841fab7dfec198b3c31af7

            SHA1

            4e7ab6336c0538be5dd7da529c0265b3b6523083

            SHA256

            169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

            SHA512

            97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

          • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe

            Filesize

            344KB

            MD5

            aec814bf30dd191b641feef457a718ce

            SHA1

            96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

            SHA256

            446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

            SHA512

            fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

          • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe

            Filesize

            344KB

            MD5

            aec814bf30dd191b641feef457a718ce

            SHA1

            96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

            SHA256

            446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

            SHA512

            fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

          • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe

            Filesize

            344KB

            MD5

            aec814bf30dd191b641feef457a718ce

            SHA1

            96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

            SHA256

            446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

            SHA512

            fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

          • C:\Users\Admin\AppData\Local\Nvidia\verybigchimpanzee.exe

            Filesize

            344KB

            MD5

            aec814bf30dd191b641feef457a718ce

            SHA1

            96c2bea5b416d10a2dae60acd2b7f9c7cebb8115

            SHA256

            446278b00e672276ebd77b7a20356f9fdad4aeb0add39d714de87f3c6b17af89

            SHA512

            fdd89bcb64728e88e5b9453f3c93c011fa2f22a5947a3d380ac2768184126c27b0e97556ace1d736cfe4da20281b5c710af78f55460948d5561c979021f5b6b0

          • C:\Users\Admin\AppData\Local\Temp\tmpCD67.tmp

            Filesize

            13.3MB

            MD5

            89d2d5811c1aff539bb355f15f3ddad0

            SHA1

            5bb3577c25b6d323d927200c48cd184a3e27c873

            SHA256

            b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

            SHA512

            39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

          • memory/1512-170-0x0000021C1CF40000-0x0000021C1CF50000-memory.dmp

            Filesize

            64KB

          • memory/1512-143-0x0000021C1CF40000-0x0000021C1CF50000-memory.dmp

            Filesize

            64KB

          • memory/1784-134-0x000001A0E75E0000-0x000001A0E75F0000-memory.dmp

            Filesize

            64KB

          • memory/1784-133-0x000001A0E5720000-0x000001A0E577C000-memory.dmp

            Filesize

            368KB

          • memory/2428-212-0x0000018EF1880000-0x0000018EF1890000-memory.dmp

            Filesize

            64KB

          • memory/3712-205-0x00000233B7040000-0x00000233B7050000-memory.dmp

            Filesize

            64KB