Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/06/2023, 13:38

General

  • Target

    07470499.exe

  • Size

    200KB

  • MD5

    5d026af9171c4bcec7b38ff42b1fb266

  • SHA1

    e97563e92862f5284352147ba3de4fca45e11f81

  • SHA256

    052cee21bf536d51bcaf66edc262a1c391dea5a941cda58b83bf1eea43037169

  • SHA512

    c5fbb96bfb4e9de7ac71ce9595678e9e724a9728bb26085f2e411d29638ffb2e74e3106375a5251b96d01f2007752559a042b22ce4594bda8a0982c588c288ce

  • SSDEEP

    3072:I+GDsJ1H1GwWQKKPMnbEB58DXKo+XEC5rBRJx0Q+R:L3H1gQKKPubEB5xo+XTBRf0Q

Malware Config

Signatures

  • Detects Lobshot family 7 IoCs
  • Lobshot

    Lobshot is a backdoor module written in c++.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07470499.exe
    "C:\Users\Admin\AppData\Local\Temp\07470499.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4972
    • C:\Users\Admin\AppData\Local\Temp\07470499.exe
      "C:\Users\Admin\AppData\Local\Temp\07470499.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\ProgramData"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4856
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c (ping -n 10 127.0.0.1) & (del /F /Q "C:\Users\Admin\AppData\Local\Temp\07470499.exe") & (start "" "C:\ProgramData\ef12ce34.exe")
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5108
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 10 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:3548
        • C:\ProgramData\ef12ce34.exe
          "C:\ProgramData\ef12ce34.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:3188
          • C:\ProgramData\ef12ce34.exe
            "C:\ProgramData\ef12ce34.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1440
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "C:\ProgramData"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3896

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\ef12ce34.exe

    Filesize

    200KB

    MD5

    5d026af9171c4bcec7b38ff42b1fb266

    SHA1

    e97563e92862f5284352147ba3de4fca45e11f81

    SHA256

    052cee21bf536d51bcaf66edc262a1c391dea5a941cda58b83bf1eea43037169

    SHA512

    c5fbb96bfb4e9de7ac71ce9595678e9e724a9728bb26085f2e411d29638ffb2e74e3106375a5251b96d01f2007752559a042b22ce4594bda8a0982c588c288ce

  • C:\ProgramData\ef12ce34.exe

    Filesize

    200KB

    MD5

    5d026af9171c4bcec7b38ff42b1fb266

    SHA1

    e97563e92862f5284352147ba3de4fca45e11f81

    SHA256

    052cee21bf536d51bcaf66edc262a1c391dea5a941cda58b83bf1eea43037169

    SHA512

    c5fbb96bfb4e9de7ac71ce9595678e9e724a9728bb26085f2e411d29638ffb2e74e3106375a5251b96d01f2007752559a042b22ce4594bda8a0982c588c288ce

  • C:\ProgramData\ef12ce34.exe

    Filesize

    200KB

    MD5

    5d026af9171c4bcec7b38ff42b1fb266

    SHA1

    e97563e92862f5284352147ba3de4fca45e11f81

    SHA256

    052cee21bf536d51bcaf66edc262a1c391dea5a941cda58b83bf1eea43037169

    SHA512

    c5fbb96bfb4e9de7ac71ce9595678e9e724a9728bb26085f2e411d29638ffb2e74e3106375a5251b96d01f2007752559a042b22ce4594bda8a0982c588c288ce

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    0a04a94adc48bb7068dbdf3b2ee9d984

    SHA1

    f781449364703e2b5db87c358f844699f30ace4d

    SHA256

    f1a24d84f391549d4ff4d4eb2ebfd9e4e56016b156c7820e596199423eaf9a4a

    SHA512

    68b3495d276dc44aba2c885da0cc79d948a9468adc4a4a7e2079dbb21974190b8f15e454165f2eba56443c2984852de8869c719e2925bbef2afe9f7077e1c799

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dfbg3qn3.iwf.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1440-190-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/1440-218-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/1440-188-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/3896-213-0x0000000004860000-0x0000000004870000-memory.dmp

    Filesize

    64KB

  • memory/3896-202-0x0000000004860000-0x0000000004870000-memory.dmp

    Filesize

    64KB

  • memory/3896-201-0x0000000004860000-0x0000000004870000-memory.dmp

    Filesize

    64KB

  • memory/3896-203-0x0000000070A70000-0x0000000070ABC000-memory.dmp

    Filesize

    304KB

  • memory/3896-214-0x000000007F190000-0x000000007F1A0000-memory.dmp

    Filesize

    64KB

  • memory/4856-146-0x0000000004C50000-0x0000000004CB6000-memory.dmp

    Filesize

    408KB

  • memory/4856-178-0x0000000006FF0000-0x0000000006FF8000-memory.dmp

    Filesize

    32KB

  • memory/4856-169-0x0000000006020000-0x000000000603E000-memory.dmp

    Filesize

    120KB

  • memory/4856-170-0x00000000024E0000-0x00000000024F0000-memory.dmp

    Filesize

    64KB

  • memory/4856-171-0x000000007EED0000-0x000000007EEE0000-memory.dmp

    Filesize

    64KB

  • memory/4856-172-0x00000000073C0000-0x0000000007A3A000-memory.dmp

    Filesize

    6.5MB

  • memory/4856-173-0x0000000006D70000-0x0000000006D8A000-memory.dmp

    Filesize

    104KB

  • memory/4856-174-0x0000000006DE0000-0x0000000006DEA000-memory.dmp

    Filesize

    40KB

  • memory/4856-175-0x0000000007000000-0x0000000007096000-memory.dmp

    Filesize

    600KB

  • memory/4856-176-0x0000000006FA0000-0x0000000006FAE000-memory.dmp

    Filesize

    56KB

  • memory/4856-177-0x00000000070C0000-0x00000000070DA000-memory.dmp

    Filesize

    104KB

  • memory/4856-159-0x0000000070AB0000-0x0000000070AFC000-memory.dmp

    Filesize

    304KB

  • memory/4856-158-0x0000000006A40000-0x0000000006A72000-memory.dmp

    Filesize

    200KB

  • memory/4856-157-0x0000000005A80000-0x0000000005A9E000-memory.dmp

    Filesize

    120KB

  • memory/4856-147-0x0000000005420000-0x0000000005486000-memory.dmp

    Filesize

    408KB

  • memory/4856-141-0x0000000002480000-0x00000000024B6000-memory.dmp

    Filesize

    216KB

  • memory/4856-145-0x0000000004AB0000-0x0000000004AD2000-memory.dmp

    Filesize

    136KB

  • memory/4856-144-0x00000000024E0000-0x00000000024F0000-memory.dmp

    Filesize

    64KB

  • memory/4856-143-0x00000000024E0000-0x00000000024F0000-memory.dmp

    Filesize

    64KB

  • memory/4856-142-0x0000000004D70000-0x0000000005398000-memory.dmp

    Filesize

    6.2MB

  • memory/4956-134-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/4956-139-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/4956-137-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/4972-136-0x0000000000630000-0x0000000000649000-memory.dmp

    Filesize

    100KB