Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/05/2023, 17:50

230526-wenjcshb41 6

26/05/2023, 16:28

230526-tyysbsgg81 8

26/05/2023, 16:06

230526-tkc9gagc69 7

26/05/2023, 16:03

230526-thrzvagc63 7

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2023, 16:03

General

  • Target

    https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Live%20Protection%20Suite%202019.zip

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Modifies registry class 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Live%20Protection%20Suite%202019.zip
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4936
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4936 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:5024
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap28062:110:7zEvent25803
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3872
  • C:\Users\Admin\Desktop\[email protected]
    "C:\Users\Admin\Desktop\[email protected]"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe
      "C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4904

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe

    Filesize

    911KB

    MD5

    2e6360eeebcafd207ad6f4cfc81afdb3

    SHA1

    6d85d48c8c809ad0ee5f7b1b20ef79e871466072

    SHA256

    3a31f386f4a68827d8cbfeb087c017f871d80ab4565a2266f692fbe6cfea9c3b

    SHA512

    36e1cadeff91158c0e96585d7550dc193a6470f5fccf3cf98845c4291becc6dae39609771cc8157493bc6cb405446ac55a1790108c6c213293bf4a56ecf381e4

  • C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe

    Filesize

    911KB

    MD5

    2e6360eeebcafd207ad6f4cfc81afdb3

    SHA1

    6d85d48c8c809ad0ee5f7b1b20ef79e871466072

    SHA256

    3a31f386f4a68827d8cbfeb087c017f871d80ab4565a2266f692fbe6cfea9c3b

    SHA512

    36e1cadeff91158c0e96585d7550dc193a6470f5fccf3cf98845c4291becc6dae39609771cc8157493bc6cb405446ac55a1790108c6c213293bf4a56ecf381e4

  • C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe

    Filesize

    911KB

    MD5

    2e6360eeebcafd207ad6f4cfc81afdb3

    SHA1

    6d85d48c8c809ad0ee5f7b1b20ef79e871466072

    SHA256

    3a31f386f4a68827d8cbfeb087c017f871d80ab4565a2266f692fbe6cfea9c3b

    SHA512

    36e1cadeff91158c0e96585d7550dc193a6470f5fccf3cf98845c4291becc6dae39609771cc8157493bc6cb405446ac55a1790108c6c213293bf4a56ecf381e4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\Live%20Protection%20Suite%202019[1].zip

    Filesize

    1010KB

    MD5

    7a5994fab80a2ed6adf59a93c7bc2d88

    SHA1

    fe2ddcefd45c378dfb19817de118fcf151c59b1f

    SHA256

    6ebad2ea4d537eb1ce11dd19d495fca3e2b8b4e50140d9b241b71f5f1bc71804

    SHA512

    5ba499f12ed0a5de31350530402327dc323aae7d414ee972bd652265e5226adef71d94c0b52a3bf0ebe8f95081c3c27708758ef15da58163492afdb664e08ad2

  • C:\Users\Admin\Desktop\[email protected]

    Filesize

    1.1MB

    MD5

    2eb3ce80b26345bd139f7378330b19c1

    SHA1

    10122bd8dd749e20c132d108d176794f140242b0

    SHA256

    8abed3ea04d52c42bdd6c9169c59212a7d8c649c12006b8278eda5aa91154cd2

    SHA512

    e3223cd07d59cd97893304a3632b3a66fd91635848160c33011c103cca2badbfe9b78fe258666b634e455872f3a98889ede5a425d8fae91cae6983da1ea1190a

  • C:\Users\Admin\Desktop\[email protected]

    Filesize

    1.1MB

    MD5

    2eb3ce80b26345bd139f7378330b19c1

    SHA1

    10122bd8dd749e20c132d108d176794f140242b0

    SHA256

    8abed3ea04d52c42bdd6c9169c59212a7d8c649c12006b8278eda5aa91154cd2

    SHA512

    e3223cd07d59cd97893304a3632b3a66fd91635848160c33011c103cca2badbfe9b78fe258666b634e455872f3a98889ede5a425d8fae91cae6983da1ea1190a

  • C:\Users\Admin\Desktop\[email protected]

    Filesize

    1.1MB

    MD5

    2eb3ce80b26345bd139f7378330b19c1

    SHA1

    10122bd8dd749e20c132d108d176794f140242b0

    SHA256

    8abed3ea04d52c42bdd6c9169c59212a7d8c649c12006b8278eda5aa91154cd2

    SHA512

    e3223cd07d59cd97893304a3632b3a66fd91635848160c33011c103cca2badbfe9b78fe258666b634e455872f3a98889ede5a425d8fae91cae6983da1ea1190a

  • C:\Users\Admin\Desktop\Live Protection Suite 2019.zip.m52gi0x.partial

    Filesize

    1010KB

    MD5

    7a5994fab80a2ed6adf59a93c7bc2d88

    SHA1

    fe2ddcefd45c378dfb19817de118fcf151c59b1f

    SHA256

    6ebad2ea4d537eb1ce11dd19d495fca3e2b8b4e50140d9b241b71f5f1bc71804

    SHA512

    5ba499f12ed0a5de31350530402327dc323aae7d414ee972bd652265e5226adef71d94c0b52a3bf0ebe8f95081c3c27708758ef15da58163492afdb664e08ad2

  • memory/4904-182-0x0000000001180000-0x0000000001190000-memory.dmp

    Filesize

    64KB

  • memory/4904-184-0x0000000001180000-0x0000000001190000-memory.dmp

    Filesize

    64KB

  • memory/4904-177-0x000000001CBB0000-0x000000001CD4C000-memory.dmp

    Filesize

    1.6MB

  • memory/4904-178-0x000000001CE00000-0x000000001CEA6000-memory.dmp

    Filesize

    664KB

  • memory/4904-179-0x000000001CF50000-0x000000001CFEC000-memory.dmp

    Filesize

    624KB

  • memory/4904-180-0x00000000015C0000-0x00000000015C8000-memory.dmp

    Filesize

    32KB

  • memory/4904-181-0x000000001D0A0000-0x000000001D0EC000-memory.dmp

    Filesize

    304KB

  • memory/4904-174-0x0000000000CF0000-0x0000000000D10000-memory.dmp

    Filesize

    128KB

  • memory/4904-176-0x0000000001180000-0x0000000001190000-memory.dmp

    Filesize

    64KB

  • memory/4904-175-0x000000001C110000-0x000000001C5DE000-memory.dmp

    Filesize

    4.8MB

  • memory/4904-183-0x0000000001180000-0x0000000001190000-memory.dmp

    Filesize

    64KB

  • memory/4904-186-0x0000000001180000-0x0000000001190000-memory.dmp

    Filesize

    64KB

  • memory/4904-187-0x0000000001180000-0x0000000001190000-memory.dmp

    Filesize

    64KB

  • memory/4904-188-0x0000000001180000-0x0000000001190000-memory.dmp

    Filesize

    64KB

  • memory/4904-189-0x0000000001180000-0x0000000001190000-memory.dmp

    Filesize

    64KB

  • memory/4904-190-0x0000000001180000-0x0000000001190000-memory.dmp

    Filesize

    64KB

  • memory/4904-191-0x0000000001180000-0x0000000001190000-memory.dmp

    Filesize

    64KB