Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/03/2024, 22:18

240308-18e7asha96 10

08/03/2024, 22:11

240308-134byaha27 10

Analysis

  • max time kernel
    46s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20240215-es
  • resource tags

    arch:x64arch:x86image:win7-20240215-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    08/03/2024, 22:11

General

  • Target

    DFIR.exe

  • Size

    2.8MB

  • MD5

    e372d1ba2d3a1936e3e8cdd3febf2038

  • SHA1

    06ed6e0be895945bc78adac9aa0283e50fc93349

  • SHA256

    137197636e52f813606d4d979a270447888336d3403d3c94fe39310a903a59f9

  • SHA512

    058da6b05b73ba3d0a72d9565d9e663cec8857da03f3361fd6b6557f181c000d7c9c9668fa46b609f1568bc77e4485e494aae825b5b33efed2c1bb3c93d87e70

  • SSDEEP

    49152:f5UX4uCXsw6rBbn0zdkfnDV/4TE6/lIKiebQ+LTq4ujYv9XiwuPNhO8NX:f5UX4JF6rBYzyfGTJ/lIVebQ+L2ZsVSR

Malware Config

Signatures

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Contacts a large (20060) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • XMRig Miner payload 6 IoCs
  • Creates new service(s) 1 TTPs
  • Stops running service(s) 3 TTPs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 21 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: LoadsDriver 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DFIR.exe
    "C:\Users\Admin\AppData\Local\Temp\DFIR.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc stop npf"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\system32\sc.exe
        sc stop npf
        3⤵
        • Launches sc.exe
        PID:2712
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc delete npf"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Windows\system32\sc.exe
        sc delete npf
        3⤵
        • Launches sc.exe
        PID:2576
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Windows\system32\sc.exe
        sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys
        3⤵
        • Launches sc.exe
        PID:2624
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc start npf"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\system32\sc.exe
        sc start npf
        3⤵
        • Launches sc.exe
        PID:2524
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "netstat -ano | findstr TCP"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\system32\NETSTAT.EXE
        netstat -ano
        3⤵
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:2616
      • C:\Windows\system32\findstr.exe
        findstr TCP
        3⤵
          PID:2648
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
          3⤵
          • Modifies registry class
          PID:2044
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2636
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
          3⤵
          • Modifies registry class
          PID:1832
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1592
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
          3⤵
          • Modifies registry class
          PID:380
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2052
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
          3⤵
          • Modifies registry class
          PID:692
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:532
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
          3⤵
          • Modifies registry class
          PID:1764
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
        2⤵
          PID:2080
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
            3⤵
            • Modifies registry class
            PID:1736
        • C:\Windows\system32\cmd.exe
          cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
          2⤵
            PID:984
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
              3⤵
              • Modifies registry class
              PID:3060
          • C:\Windows\system32\cmd.exe
            cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
            2⤵
              PID:912
              • C:\Windows\system32\rundll32.exe
                "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                3⤵
                • Modifies registry class
                PID:2568
            • C:\Windows\system32\cmd.exe
              cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
              2⤵
                PID:2504
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                  3⤵
                  • Modifies registry class
                  PID:2424
              • C:\Windows\system32\cmd.exe
                cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                2⤵
                  PID:2668
                  • C:\Windows\system32\rundll32.exe
                    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                    3⤵
                    • Modifies registry class
                    PID:1620
                • C:\Windows\system32\cmd.exe
                  cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                  2⤵
                    PID:1488
                    • C:\Windows\system32\rundll32.exe
                      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                      3⤵
                      • Modifies registry class
                      PID:1492
                  • C:\Windows\system32\cmd.exe
                    cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                    2⤵
                      PID:1804
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                        3⤵
                        • Modifies registry class
                        PID:888
                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk"
                          4⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:1600
                    • C:\Windows\system32\cmd.exe
                      cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                      2⤵
                        PID:852
                        • C:\Windows\system32\rundll32.exe
                          "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                          3⤵
                          • Modifies registry class
                          PID:1740
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                        2⤵
                          PID:2968
                          • C:\Windows\system32\rundll32.exe
                            "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                            3⤵
                            • Modifies registry class
                            PID:2148
                        • C:\Windows\system32\cmd.exe
                          cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                          2⤵
                            PID:1692
                            • C:\Windows\system32\rundll32.exe
                              "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                              3⤵
                              • Modifies registry class
                              PID:1568
                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk"
                                4⤵
                                  PID:2524
                            • C:\Windows\system32\cmd.exe
                              cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                              2⤵
                                PID:2620
                                • C:\Windows\system32\rundll32.exe
                                  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                  3⤵
                                  • Modifies registry class
                                  PID:2700
                              • C:\Windows\system32\cmd.exe
                                cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                2⤵
                                  PID:2688
                                  • C:\Windows\system32\rundll32.exe
                                    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                    3⤵
                                    • Modifies registry class
                                    PID:1612
                                • C:\Windows\system32\cmd.exe
                                  cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                  2⤵
                                    PID:1240
                                    • C:\Windows\system32\rundll32.exe
                                      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                      3⤵
                                      • Modifies registry class
                                      PID:2736
                                  • C:\Windows\system32\cmd.exe
                                    cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                    2⤵
                                      PID:496
                                      • C:\Windows\system32\rundll32.exe
                                        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                        3⤵
                                        • Modifies registry class
                                        PID:1664
                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk"
                                          4⤵
                                            PID:1036
                                      • C:\Windows\system32\cmd.exe
                                        cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                        2⤵
                                          PID:1820
                                          • C:\Windows\system32\rundll32.exe
                                            "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                            3⤵
                                            • Modifies registry class
                                            PID:2184
                                        • C:\Windows\system32\cmd.exe
                                          cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                          2⤵
                                            PID:2968
                                            • C:\Windows\system32\rundll32.exe
                                              "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk
                                              3⤵
                                              • Modifies registry class
                                              PID:1684

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Temp\tr01xa\WinRing0x64.sys

                                          Filesize

                                          14KB

                                          MD5

                                          0c0195c48b6b8582fa6f6373032118da

                                          SHA1

                                          d25340ae8e92a6d29f599fef426a2bc1b5217299

                                          SHA256

                                          11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

                                          SHA512

                                          ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

                                        • C:\Users\Admin\AppData\Local\Temp\tr01xa\config.json

                                          Filesize

                                          1KB

                                          MD5

                                          8afbb1177ab70f9d24dacd22a6793ee4

                                          SHA1

                                          b7ba0a4bd964868922143bedb93470202c0bfef4

                                          SHA256

                                          54f0d371f9918c81e3ce7a557d6da1ac4639995c5a6e409822f0e496d3a1d290

                                          SHA512

                                          2d05fb6e7e39b499b27aed4a7adf77fce1dcedc335d969be157dec91a78ed7b839ba50887d5a6de1b6f3635ae7d35dc6cd1ec064590ef76fe3ae8443fdaa5624

                                        • C:\Users\Admin\AppData\Local\Temp\tr01xa\kthreaddk

                                          Filesize

                                          2.0MB

                                          MD5

                                          a7013a2c7fd3a6168a7c0d9eed825c32

                                          SHA1

                                          a3b6cf6090a425466606125aa881fdf56c1c2a67

                                          SHA256

                                          a2f3ecd329d2713855257bf922b8a092cbb1193327ba197351804275286df7dd

                                          SHA512

                                          e2e6e447806adb5d27c77f8dc32772fc49ba5532e255e1a38e92a404efccbc8f3d820d4d674a51968e5c3c1079cb834253232bf13e6ff9d437c7d0e2551ba49d

                                        • \Users\Admin\AppData\Local\Temp\Packet.dll

                                          Filesize

                                          105KB

                                          MD5

                                          899a5bf1669610cdb78d322ac8d9358b

                                          SHA1

                                          80a2e420b99ffe294a523c6c6d87ed09dfc8d82b

                                          SHA256

                                          ab3cce674f5216895fd26a073771f82b05d4c8b214a89f0f288a59774a06b14b

                                          SHA512

                                          41f2459793ac04e433d8471780e770417afac499dc3c5413877d4a4499656c9669c069d24e638d0aaf43af178a763acb656ffd34d710eb5e3c94682db1559056

                                        • \Users\Admin\AppData\Local\Temp\wpcap.dll

                                          Filesize

                                          361KB

                                          MD5

                                          a672f1cf00fa5ac3f4f59577f77d8c86

                                          SHA1

                                          b68e64401d91c75cafa810086a35cd0838c61a4b

                                          SHA256

                                          35aab6caaaf1720a4d888ae0de9e2a8e19604f3ea0e4dd882c3eeae4f39af117

                                          SHA512

                                          a566e7571437be765279c915dd6e13f72203eff0dc3838a154fc137ed828e05644d650fd8432d1fb4c1e1d84ee00ef9bde90225c68c3ca8a5da349065e7ebfd6

                                        • memory/2160-0-0x0000000000400000-0x000000000152F000-memory.dmp

                                          Filesize

                                          17.2MB

                                        • memory/2160-8-0x00000000003E0000-0x00000000003FF000-memory.dmp

                                          Filesize

                                          124KB

                                        • memory/2160-269-0x0000000000400000-0x000000000152F000-memory.dmp

                                          Filesize

                                          17.2MB

                                        • memory/2160-368-0x0000000000400000-0x000000000152F000-memory.dmp

                                          Filesize

                                          17.2MB

                                        • memory/2160-567-0x0000000000400000-0x000000000152F000-memory.dmp

                                          Filesize

                                          17.2MB

                                        • memory/2160-699-0x0000000000400000-0x000000000152F000-memory.dmp

                                          Filesize

                                          17.2MB

                                        • memory/2160-706-0x0000000000400000-0x000000000152F000-memory.dmp

                                          Filesize

                                          17.2MB