Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
291s -
max time network
187s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/03/2024, 22:41
Static task
static1
Behavioral task
behavioral1
Sample
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe
Resource
win7-20240220-en
General
-
Target
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe
-
Size
419KB
-
MD5
27499cf0e73817392b9f50cc9e82c2b3
-
SHA1
a0efab9cdb4b2a4a920f4ab76095d24806d7812f
-
SHA256
bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458
-
SHA512
94b6768d229da70e558ede3b339b99f3c67657f5ce6b76d123a9df0226c3c6677e9585dd42fa5a74df901e7b0cc3dd0a89a0c9bfc82271706b4af97a00f4f414
-
SSDEEP
6144:dOpt5U2F/o+89gzpGzlpKmu9HiFqVOmZce8dsGlEpD:Q5U2FQ+8+cpKmu9HikghdsG2h
Malware Config
Extracted
amadey
4.18
-
install_dir
154561dcbf
-
install_file
Dctooux.exe
-
strings_key
2cd47fa043c815e1a033c67832f3c6a5
-
url_paths
/j4Fvskd3/index.php
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 9 2476 rundll32.exe 12 2420 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2708 Dctooux.exe -
Loads dropped DLL 14 IoCs
pid Process 2176 bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 2176 bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 2508 rundll32.exe 2508 rundll32.exe 2508 rundll32.exe 2508 rundll32.exe 2476 rundll32.exe 2476 rundll32.exe 2476 rundll32.exe 2476 rundll32.exe 2420 rundll32.exe 2420 rundll32.exe 2420 rundll32.exe 2420 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Dctooux.job bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2476 rundll32.exe 2476 rundll32.exe 2476 rundll32.exe 2476 rundll32.exe 2476 rundll32.exe 2964 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2964 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2176 bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2708 2176 bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 28 PID 2176 wrote to memory of 2708 2176 bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 28 PID 2176 wrote to memory of 2708 2176 bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 28 PID 2176 wrote to memory of 2708 2176 bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe 28 PID 2708 wrote to memory of 2508 2708 Dctooux.exe 30 PID 2708 wrote to memory of 2508 2708 Dctooux.exe 30 PID 2708 wrote to memory of 2508 2708 Dctooux.exe 30 PID 2708 wrote to memory of 2508 2708 Dctooux.exe 30 PID 2708 wrote to memory of 2508 2708 Dctooux.exe 30 PID 2708 wrote to memory of 2508 2708 Dctooux.exe 30 PID 2708 wrote to memory of 2508 2708 Dctooux.exe 30 PID 2508 wrote to memory of 2476 2508 rundll32.exe 31 PID 2508 wrote to memory of 2476 2508 rundll32.exe 31 PID 2508 wrote to memory of 2476 2508 rundll32.exe 31 PID 2508 wrote to memory of 2476 2508 rundll32.exe 31 PID 2476 wrote to memory of 2960 2476 rundll32.exe 32 PID 2476 wrote to memory of 2960 2476 rundll32.exe 32 PID 2476 wrote to memory of 2960 2476 rundll32.exe 32 PID 2476 wrote to memory of 2964 2476 rundll32.exe 34 PID 2476 wrote to memory of 2964 2476 rundll32.exe 34 PID 2476 wrote to memory of 2964 2476 rundll32.exe 34 PID 2708 wrote to memory of 2420 2708 Dctooux.exe 36 PID 2708 wrote to memory of 2420 2708 Dctooux.exe 36 PID 2708 wrote to memory of 2420 2708 Dctooux.exe 36 PID 2708 wrote to memory of 2420 2708 Dctooux.exe 36 PID 2708 wrote to memory of 2420 2708 Dctooux.exe 36 PID 2708 wrote to memory of 2420 2708 Dctooux.exe 36 PID 2708 wrote to memory of 2420 2708 Dctooux.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe"C:\Users\Admin\AppData\Local\Temp\bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"C:\Users\Admin\AppData\Local\Temp\154561dcbf\Dctooux.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\cred64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵PID:2960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\721934792624_Desktop.zip' -CompressionLevel Optimal5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\810b84e2bfa3a9\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2420
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD52472dcc6863950a9dd646087887ebbaf
SHA1c6ffa1e565005db68cc4f469908fda722cc01e4e
SHA256cfce278bd64d49ec31e9ffdc11e2594dffc8cac58ffc9103b6a660393cf767f6
SHA512ba1d23b554a7cfbec3d6c12efe867c1e709f773c439bd968271e3bc0d0a638e533b86bf157e0372f93aac0e4bd7a87b817db3c909378a9b65808f8ecaf200718
-
Filesize
1.2MB
MD54876ee75ce2712147c41ff1277cd2d30
SHA13733dc92318f0c6b92cb201e49151686281acda6
SHA256bbfba2d40f48c16a53b5806555c08aff1982c3fe4a77964963edbab9d7e672ed
SHA5129bf25d4d0dfebd287b0c84abb64612b3db00a26b0217490b35925e77487d6c872632c936cedf1205c46ecbf9d4dfc9bc7600bee05afc550b30ae0d0964c5afe9
-
Filesize
419KB
MD527499cf0e73817392b9f50cc9e82c2b3
SHA1a0efab9cdb4b2a4a920f4ab76095d24806d7812f
SHA256bbe53788c93f1feb8c52908d74ae463d58addef354242fb4bfa423560ea82458
SHA51294b6768d229da70e558ede3b339b99f3c67657f5ce6b76d123a9df0226c3c6677e9585dd42fa5a74df901e7b0cc3dd0a89a0c9bfc82271706b4af97a00f4f414
-
Filesize
109KB
MD5ca684dc5ebed4381701a39f1cc3a0fb2
SHA18c4a375aa583bd1c705597a7f45fd18934276770
SHA256b8c5ad09c5b62fa8d8bcb8e1c317700274b4756d04fc964ccae38103c318ddd2
SHA5128b414799e37d50f664e04e704ab06a8f6f25cb9f9c24f157e998a72aad9c0a0cd9435b42c629dc26643f039725d22a89ca3468dc39009d11d910420a80e9c510