Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    06/02/2024, 13:20

General

  • Target

    94991507c04f29915d7afeb6a1ce2c0b.exe

  • Size

    429KB

  • MD5

    94991507c04f29915d7afeb6a1ce2c0b

  • SHA1

    bb71a4a11a793cd6e4554e6cfa415bc93509599d

  • SHA256

    0369d29e8f8ac8c5408ade862673a5220f39e9f79cf68ad4d0e692c843e3ff9f

  • SHA512

    b1df63faa49c0f5aed4973375e2b70da477126f1b651418be038ba66ddadee7e89cf20db56504e0d8d42a01490cc6312613c72e82056ed1ade4af6693df734b0

  • SSDEEP

    12288:gErZ1tp5Be+DDqzzATxOife+iOANdt8DKxvqcldx/oVIY:gE9x5bXE8oif9U8DKRqEdx/x

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

10030

C2

jscallowallowallowjcli.me

disallowjscuserallow.pw

Attributes
  • build

    215790

  • dga_base_url

    z1.zedo.com/robots.txt

  • dga_crc

    0x246640bb

  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\94991507c04f29915d7afeb6a1ce2c0b.exe
      "C:\Users\Admin\AppData\Local\Temp\94991507c04f29915d7afeb6a1ce2c0b.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\85B4\42DA.bat" "C:\Users\Admin\AppData\Roaming\Audiedit\amxrerop.exe" "C:\Users\Admin\AppData\Local\Temp\949915~1.EXE""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2340
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C ""C:\Users\Admin\AppData\Roaming\Audiedit\amxrerop.exe" "C:\Users\Admin\AppData\Local\Temp\949915~1.EXE""
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Users\Admin\AppData\Roaming\Audiedit\amxrerop.exe
            "C:\Users\Admin\AppData\Roaming\Audiedit\amxrerop.exe" "C:\Users\Admin\AppData\Local\Temp\949915~1.EXE"
            5⤵
            • Deletes itself
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2788
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              6⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\85B4\42DA.bat

    Filesize

    112B

    MD5

    25ed7e258d74edf77d9f17725d88ddf8

    SHA1

    727cc6cfe22b941d45f9aaae9ca49c0f4fdb44fe

    SHA256

    89de0f0678f1d1d3f924589fbf24c5ef9f517d45db65a922291e553009a19962

    SHA512

    9fd6cec31f46daccf0a1d3692353803d37a864332e898b0e38f0cf21a4a63cc5537d0001f1d70247f9eaccaa5de6bc98964553fd7065a79b8f827d4e30913db3

  • \Users\Admin\AppData\Roaming\Audiedit\amxrerop.exe

    Filesize

    429KB

    MD5

    94991507c04f29915d7afeb6a1ce2c0b

    SHA1

    bb71a4a11a793cd6e4554e6cfa415bc93509599d

    SHA256

    0369d29e8f8ac8c5408ade862673a5220f39e9f79cf68ad4d0e692c843e3ff9f

    SHA512

    b1df63faa49c0f5aed4973375e2b70da477126f1b651418be038ba66ddadee7e89cf20db56504e0d8d42a01490cc6312613c72e82056ed1ade4af6693df734b0

  • memory/1244-39-0x0000000006EC0000-0x0000000006FC1000-memory.dmp

    Filesize

    1.0MB

  • memory/1244-29-0x0000000006EC0000-0x0000000006FC1000-memory.dmp

    Filesize

    1.0MB

  • memory/1244-43-0x0000000006EC0000-0x0000000006FC1000-memory.dmp

    Filesize

    1.0MB

  • memory/1244-41-0x0000000006EC0000-0x0000000006FC1000-memory.dmp

    Filesize

    1.0MB

  • memory/1244-42-0x0000000006EC0000-0x0000000006FC1000-memory.dmp

    Filesize

    1.0MB

  • memory/1244-40-0x0000000006EC0000-0x0000000006FC1000-memory.dmp

    Filesize

    1.0MB

  • memory/1244-32-0x0000000002B90000-0x0000000002B91000-memory.dmp

    Filesize

    4KB

  • memory/1688-1-0x0000000000480000-0x00000000004E5000-memory.dmp

    Filesize

    404KB

  • memory/1688-12-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/1688-0-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/1688-13-0x0000000000480000-0x00000000004E5000-memory.dmp

    Filesize

    404KB

  • memory/2724-22-0x000007FFFFFD7000-0x000007FFFFFD8000-memory.dmp

    Filesize

    4KB

  • memory/2724-23-0x0000000000520000-0x0000000000621000-memory.dmp

    Filesize

    1.0MB

  • memory/2724-31-0x0000000000520000-0x0000000000621000-memory.dmp

    Filesize

    1.0MB

  • memory/2724-34-0x0000000000520000-0x0000000000621000-memory.dmp

    Filesize

    1.0MB

  • memory/2724-26-0x0000000000020000-0x0000000000021000-memory.dmp

    Filesize

    4KB

  • memory/2788-24-0x0000000000400000-0x0000000000474000-memory.dmp

    Filesize

    464KB

  • memory/2788-21-0x0000000000310000-0x0000000000375000-memory.dmp

    Filesize

    404KB