Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2024, 22:24

General

  • Target

    a2dac4450c8268e2c3ab41b28da9f6de.exe

  • Size

    13.3MB

  • MD5

    a2dac4450c8268e2c3ab41b28da9f6de

  • SHA1

    4c112829564be4fd7208b5388b641a8ab68eefb7

  • SHA256

    a6f0edcc4248c96cf33015626c80868eb1c9ed47198317c7add48ce23638c83f

  • SHA512

    bc58ad5a68d7f3238bc59d775b28fc195859f3b42f20cf12dc8748d7f2e4e5d25d7080cc260990262f5d5760ecf51be5d9330c5a4bea7e886c33959bb6c33f82

  • SSDEEP

    196608:5V8YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY/:

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a2dac4450c8268e2c3ab41b28da9f6de.exe
    "C:\Users\Admin\AppData\Local\Temp\a2dac4450c8268e2c3ab41b28da9f6de.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\faibcig\
      2⤵
        PID:2068
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\czwugrgu.exe" C:\Windows\SysWOW64\faibcig\
        2⤵
          PID:2684
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create faibcig binPath= "C:\Windows\SysWOW64\faibcig\czwugrgu.exe /d\"C:\Users\Admin\AppData\Local\Temp\a2dac4450c8268e2c3ab41b28da9f6de.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2680
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description faibcig "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2732
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start faibcig
          2⤵
          • Launches sc.exe
          PID:2740
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2224
      • C:\Windows\SysWOW64\faibcig\czwugrgu.exe
        C:\Windows\SysWOW64\faibcig\czwugrgu.exe /d"C:\Users\Admin\AppData\Local\Temp\a2dac4450c8268e2c3ab41b28da9f6de.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          PID:2928

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\czwugrgu.exe

        Filesize

        13.8MB

        MD5

        a0ec1189cb975b49843ca9a3375a97aa

        SHA1

        8d09d25080a225425ae1f3d1a605f86b058c723e

        SHA256

        4767d6601850313fd5cf1d35f2e10439beb4bb1c19a7f4d8f6214c78ec5bd063

        SHA512

        ed7f88ce0e62fc830621d5637afb0a8021e3c6b24c37b65e2b34a0ba83889b3cf2f07e20eb4f694da287feadc28de43d45aa07babd907a5d84de48823791ac2c

      • memory/2160-1-0x0000000000970000-0x0000000000A70000-memory.dmp

        Filesize

        1024KB

      • memory/2160-2-0x00000000002B0000-0x00000000002C3000-memory.dmp

        Filesize

        76KB

      • memory/2160-4-0x0000000000400000-0x00000000008EA000-memory.dmp

        Filesize

        4.9MB

      • memory/2160-8-0x00000000002B0000-0x00000000002C3000-memory.dmp

        Filesize

        76KB

      • memory/2160-7-0x0000000000400000-0x00000000008EA000-memory.dmp

        Filesize

        4.9MB

      • memory/2840-10-0x0000000000A00000-0x0000000000B00000-memory.dmp

        Filesize

        1024KB

      • memory/2840-11-0x0000000000400000-0x00000000008EA000-memory.dmp

        Filesize

        4.9MB

      • memory/2840-16-0x0000000000400000-0x00000000008EA000-memory.dmp

        Filesize

        4.9MB

      • memory/2928-12-0x0000000000080000-0x0000000000095000-memory.dmp

        Filesize

        84KB

      • memory/2928-15-0x0000000000080000-0x0000000000095000-memory.dmp

        Filesize

        84KB

      • memory/2928-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2928-20-0x0000000000080000-0x0000000000095000-memory.dmp

        Filesize

        84KB

      • memory/2928-21-0x0000000000080000-0x0000000000095000-memory.dmp

        Filesize

        84KB

      • memory/2928-22-0x0000000000080000-0x0000000000095000-memory.dmp

        Filesize

        84KB