Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 14:09
Static task
static1
Behavioral task
behavioral1
Sample
New Order-F9000_pdf.exe
Resource
win7-20240319-en
General
-
Target
New Order-F9000_pdf.exe
-
Size
596KB
-
MD5
31622d9e964f5065f6940c1771ca0940
-
SHA1
a3212dad73b667a3e555cefe22512e22633f7a55
-
SHA256
ed0060d90610311944437da9ecc113e293b2800b903e5617b115d5bc48c379bd
-
SHA512
cd7dc9e49b51dce78f75f38a7bb4e7735fd836668d12d92e0ab144462fb95170f926a938bb3b1b8cbee645ddf27f53be03f2f609873c4728dd18292093c62d67
-
SSDEEP
12288:v5E0oN04j4uYuDHppCK1oIG6k7BKkCivD0qkLwPFA:uA4//cZ6kckCwD0Dw
Malware Config
Extracted
lokibot
https://sempersim.su/c17/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2220 set thread context of 2204 2220 New Order-F9000_pdf.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2736 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2220 New Order-F9000_pdf.exe 2220 New Order-F9000_pdf.exe 2220 New Order-F9000_pdf.exe 2536 powershell.exe 2916 powershell.exe 2220 New Order-F9000_pdf.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2220 New Order-F9000_pdf.exe Token: SeDebugPrivilege 2536 powershell.exe Token: SeDebugPrivilege 2916 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2536 2220 New Order-F9000_pdf.exe 28 PID 2220 wrote to memory of 2536 2220 New Order-F9000_pdf.exe 28 PID 2220 wrote to memory of 2536 2220 New Order-F9000_pdf.exe 28 PID 2220 wrote to memory of 2916 2220 New Order-F9000_pdf.exe 30 PID 2220 wrote to memory of 2916 2220 New Order-F9000_pdf.exe 30 PID 2220 wrote to memory of 2916 2220 New Order-F9000_pdf.exe 30 PID 2220 wrote to memory of 2736 2220 New Order-F9000_pdf.exe 31 PID 2220 wrote to memory of 2736 2220 New Order-F9000_pdf.exe 31 PID 2220 wrote to memory of 2736 2220 New Order-F9000_pdf.exe 31 PID 2220 wrote to memory of 2204 2220 New Order-F9000_pdf.exe 34 PID 2220 wrote to memory of 2204 2220 New Order-F9000_pdf.exe 34 PID 2220 wrote to memory of 2204 2220 New Order-F9000_pdf.exe 34 PID 2220 wrote to memory of 2204 2220 New Order-F9000_pdf.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order-F9000_pdf.exe"C:\Users\Admin\AppData\Local\Temp\New Order-F9000_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\New Order-F9000_pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tLWNXdp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tLWNXdp" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA718.tmp"2⤵
- Creates scheduled task(s)
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\New Order-F9000_pdf.exe"C:\Users\Admin\AppData\Local\Temp\New Order-F9000_pdf.exe"2⤵PID:2204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ec1a64ac3b95f71516f0b783d27ec443
SHA152a4c4a2c49c5c235c39abdd293ada46530a6791
SHA2569b039a5f4eac465dbbac227a6a369acc19279831a80bca130d57f62ae44daf43
SHA512d549110a7fa9ff0cf48fc99206a5dde8f87d4b066a9fcd175ffa4f4d8fcc840fb6d59af92c184247710ebd99253142e7edcffaf51e1b1b97b916c1e410138577
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD509e05c979ecc2151a8813433ae5632cd
SHA1f470d1004c4104d4263d76a59213bf1a5e5457a0
SHA25639e6f4eb19e86e35f6b7a2886c691bb8c49a34f1ae4f0ae77cc73da8277d3a00
SHA5125e3e5bbe5e559e37913bdf758a2eb989c500e6d5e51d88469b69890d8cdc5a2a25e2dc6a8318e1d4ed206e166101b54775e74efb4d6420cd8c6a4edfb76397c3