Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 11:32

General

  • Target

    64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe

  • Size

    313KB

  • MD5

    e26a66bfe0da89405e25a66baad95b05

  • SHA1

    4eb5c832ce940739d6c0eb1b4fc7a78def1dd15e

  • SHA256

    64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b

  • SHA512

    2b24ae439a012e0dd8c0cf2669909d9e4b3ffa937dd856dd149db72ca231d749d63e7e960d41e57649b72b17f35f8b030d34f12e33aef6d4451e000ea4a2eb78

  • SSDEEP

    6144:DDKW1Lgbdl0TBBvjc/h6iNYKfER27VcHmb7epjV5khYVyewqF:Xh1Lk70Tnvjc5zfEcapjVBNF

Malware Config

Signatures

  • Drokbk

    Drokbk is a custom .NET dropper and backdoor.

  • Drokbk payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe
    "C:\Users\Admin\AppData\Local\Temp\64f39b858c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac90f841b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create "SessionManagerService" binpath= "c:\programdata\SoftwareDistribution\SessionService.exe" start= delayed-auto
      2⤵
      • Launches sc.exe
      PID:2148
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" config "SessionManagerService" DisplayName= "Session Manager Service"
      2⤵
      • Launches sc.exe
      PID:2600
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" description "SessionManagerService" "Provides Kernel Compatibility With User Session-Management Service."
      2⤵
      • Launches sc.exe
      PID:2956
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" start "SessionManagerService"
      2⤵
      • Launches sc.exe
      PID:2624
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1380
    • \??\c:\programdata\SoftwareDistribution\SessionService.exe
      c:\programdata\SoftwareDistribution\SessionService.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2568

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\SoftwareDistribution\SessionService.exe

      Filesize

      11KB

      MD5

      14a0e5665a95714ff4951bd35eb73606

      SHA1

      0426f65ea5bcff9e0dc48e236bbec293380ccc43

      SHA256

      a8e18a84898f46cd88813838f5e69f05240c4853af2aee5917dcee3a3e2a5d5a

      SHA512

      fe44d9ae670eac4a39567c4ae8deee6f4205d4908c4f78d822e3bb586c0183de7d6efe4b45f14b92da77fc6c24f426a6af14a3280fd5d4a7faa34123e59a4720

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Windows\Temp\TarE8CE.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • memory/2224-42-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-30-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-5-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-6-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-8-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-10-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-12-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-14-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-16-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-18-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-20-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-22-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-24-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-48-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-28-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-46-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-32-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-34-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-36-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-38-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-40-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-0-0x0000000001FC0000-0x0000000002020000-memory.dmp

      Filesize

      384KB

    • memory/2224-4-0x00000000046F0000-0x000000000474E000-memory.dmp

      Filesize

      376KB

    • memory/2224-44-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-26-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-50-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-52-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-54-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-56-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-58-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-60-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-62-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-64-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-66-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-68-0x00000000046F0000-0x0000000004748000-memory.dmp

      Filesize

      352KB

    • memory/2224-1955-0x0000000004880000-0x00000000048C0000-memory.dmp

      Filesize

      256KB

    • memory/2224-1956-0x0000000004860000-0x000000000486A000-memory.dmp

      Filesize

      40KB

    • memory/2224-1-0x0000000074A60000-0x000000007514E000-memory.dmp

      Filesize

      6.9MB

    • memory/2224-3-0x0000000004880000-0x00000000048C0000-memory.dmp

      Filesize

      256KB

    • memory/2224-2-0x0000000004880000-0x00000000048C0000-memory.dmp

      Filesize

      256KB

    • memory/2224-1965-0x0000000074A60000-0x000000007514E000-memory.dmp

      Filesize

      6.9MB

    • memory/2224-1967-0x0000000074A60000-0x000000007514E000-memory.dmp

      Filesize

      6.9MB

    • memory/2568-1968-0x0000000074A60000-0x000000007514E000-memory.dmp

      Filesize

      6.9MB

    • memory/2568-1966-0x0000000074A60000-0x000000007514E000-memory.dmp

      Filesize

      6.9MB

    • memory/2568-1964-0x00000000013C0000-0x00000000013CA000-memory.dmp

      Filesize

      40KB