Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2023, 21:27
Static task
static1
Behavioral task
behavioral1
Sample
b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe
Resource
win10v2004-20231020-en
General
-
Target
b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe
-
Size
2.2MB
-
MD5
3394aa9dfb48e470547e7f8628375edc
-
SHA1
61a0e1e57a660aebdb36db1a27af1455370d6510
-
SHA256
b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210
-
SHA512
6faf184af17608b71fd5bc5a4a0d50b3649d53647acea4aee52a18696fdc77aa8c85bed55281e27dbb395eefcf2db7a92b5be5b7389f69d9d517c11338a62fcc
-
SSDEEP
49152:ZqCY2nf4AUBeTNQqw/H2a2fidVEtMoo9SSwMKJrEmzuZWj7T:Exqf1pdw/bD8OkXcE
Malware Config
Extracted
lokibot
https://sempersim.su/a21/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\svchost.exe = "0" svchost.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 4012 svchost.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\svchost.exe = "0" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths svchost.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook calc.exe Key opened \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook calc.exe Key opened \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook calc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4012 set thread context of 2276 4012 svchost.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4308 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4276 timeout.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 4436 powershell.exe 4436 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe Token: SeDebugPrivilege 4012 svchost.exe Token: SeDebugPrivilege 4436 powershell.exe Token: SeDebugPrivilege 2276 calc.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3036 wrote to memory of 5040 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 87 PID 3036 wrote to memory of 5040 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 87 PID 3036 wrote to memory of 5040 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 87 PID 3036 wrote to memory of 5048 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 89 PID 3036 wrote to memory of 5048 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 89 PID 3036 wrote to memory of 5048 3036 b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe 89 PID 5048 wrote to memory of 4276 5048 cmd.exe 92 PID 5048 wrote to memory of 4276 5048 cmd.exe 92 PID 5048 wrote to memory of 4276 5048 cmd.exe 92 PID 5040 wrote to memory of 4308 5040 cmd.exe 91 PID 5040 wrote to memory of 4308 5040 cmd.exe 91 PID 5040 wrote to memory of 4308 5040 cmd.exe 91 PID 5048 wrote to memory of 4012 5048 cmd.exe 93 PID 5048 wrote to memory of 4012 5048 cmd.exe 93 PID 5048 wrote to memory of 4012 5048 cmd.exe 93 PID 4012 wrote to memory of 4436 4012 svchost.exe 94 PID 4012 wrote to memory of 4436 4012 svchost.exe 94 PID 4012 wrote to memory of 4436 4012 svchost.exe 94 PID 4012 wrote to memory of 2276 4012 svchost.exe 96 PID 4012 wrote to memory of 2276 4012 svchost.exe 96 PID 4012 wrote to memory of 2276 4012 svchost.exe 96 PID 4012 wrote to memory of 2276 4012 svchost.exe 96 PID 4012 wrote to memory of 2276 4012 svchost.exe 96 PID 4012 wrote to memory of 2276 4012 svchost.exe 96 PID 4012 wrote to memory of 2276 4012 svchost.exe 96 PID 4012 wrote to memory of 2276 4012 svchost.exe 96 PID 4012 wrote to memory of 2276 4012 svchost.exe 96 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook calc.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook calc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe"C:\Users\Admin\AppData\Local\Temp\b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
PID:4308
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC9C8.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:4276
-
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4012 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SYSWOW64\calc.exe"4⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2276
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
151B
MD5f5976e1a739c3ba553be459252b23d5f
SHA1e825e74e1b3769d1764ff01e46f3d101f57b36ce
SHA256b19f8d16e3e4b49534c1506cae92cc8d595b49cbe61c49d13cfc3081aed70350
SHA512d8914696520fe075a4b4b72dce7e62c885b6c970c09c2e059e363978f80643e0c4dbd8c1a271859c3f65bdcb8f24ba6104d8076a1a055ea7a3575706952fad29
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3350690463-3549324357-1323838019-1000\0f5007522459c86e95ffcc62f32308f1_8dd0f91a-4270-42e5-8227-0b93c4fef504
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3350690463-3549324357-1323838019-1000\0f5007522459c86e95ffcc62f32308f1_8dd0f91a-4270-42e5-8227-0b93c4fef504
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
Filesize
2.2MB
MD53394aa9dfb48e470547e7f8628375edc
SHA161a0e1e57a660aebdb36db1a27af1455370d6510
SHA256b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210
SHA5126faf184af17608b71fd5bc5a4a0d50b3649d53647acea4aee52a18696fdc77aa8c85bed55281e27dbb395eefcf2db7a92b5be5b7389f69d9d517c11338a62fcc
-
Filesize
2.2MB
MD53394aa9dfb48e470547e7f8628375edc
SHA161a0e1e57a660aebdb36db1a27af1455370d6510
SHA256b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210
SHA5126faf184af17608b71fd5bc5a4a0d50b3649d53647acea4aee52a18696fdc77aa8c85bed55281e27dbb395eefcf2db7a92b5be5b7389f69d9d517c11338a62fcc