Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    29/04/2024, 00:41

General

  • Target

    a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe

  • Size

    858KB

  • MD5

    be0e619026ab61ce6f26cfac1662abe5

  • SHA1

    c62908e7042a7c1ccd63d3c14924e6231e983e69

  • SHA256

    a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7

  • SHA512

    453b6478100234d470e1c9cd340424482d31e7aba931494a044278160efb48017983d3982b64100f7c6ae462f5f01136f3b80cc39dea32b66aff0f1d0e746fb3

  • SSDEEP

    12288:zJB0lh5aILwtFPCfmAUtFC6NXbv+GEBQqtGSs9U3NL9WEEoLPw9IWPzX:zQ5aILMCfmAUjzX6xQt9U3917LwpP7

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 5 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe
    "C:\Users\Admin\AppData\Local\Temp\a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Windows\SysWOW64\cmd.exe
      /c sc stop WinDefend
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\SysWOW64\sc.exe
        sc stop WinDefend
        3⤵
        • Launches sc.exe
        PID:2588
    • C:\Windows\SysWOW64\cmd.exe
      /c sc delete WinDefend
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Windows\SysWOW64\sc.exe
        sc delete WinDefend
        3⤵
        • Launches sc.exe
        PID:340
    • C:\Windows\SysWOW64\cmd.exe
      /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-MpPreference -DisableRealtimeMonitoring $true
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:760
    • C:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Windows\SysWOW64\cmd.exe
        /c sc stop WinDefend
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Windows\SysWOW64\sc.exe
          sc stop WinDefend
          4⤵
          • Launches sc.exe
          PID:1896
      • C:\Windows\SysWOW64\cmd.exe
        /c sc delete WinDefend
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\SysWOW64\sc.exe
          sc delete WinDefend
          4⤵
          • Launches sc.exe
          PID:1300
      • C:\Windows\SysWOW64\cmd.exe
        /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2580
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell Set-MpPreference -DisableRealtimeMonitoring $true
          4⤵
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1412
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:2544
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {7B02735A-CE8A-46B6-AA34-777A9D967663} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
        PID:380
        • C:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe
          C:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:812
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe
            3⤵
              PID:2296
          • C:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe
            C:\Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:568
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe
              3⤵
                PID:2232

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

            Filesize

            7KB

            MD5

            078e65f72849cb872d807ff9283da03d

            SHA1

            88e5cb320422677b9078c709671bab1688ff00cd

            SHA256

            ed572b9c9fa940a0f3d1cdecb53d55943379af118b154714b768d541acfec2ef

            SHA512

            ea6696f07deb3344e0fd8672973dcb71c83c67a2fa5e94703d2b59a112fcf3ff29f5cea3ba54bb0b0581811406f7fc35cfbe4b907df7bccfc0df41e15ed23172

          • \Users\Admin\AppData\Roaming\WinSocket\a497d2a0b7b71b32aa9c2767cf3bc41f4e62e9a9e42d1acc3d4ded7899d8bed8.exe

            Filesize

            858KB

            MD5

            be0e619026ab61ce6f26cfac1662abe5

            SHA1

            c62908e7042a7c1ccd63d3c14924e6231e983e69

            SHA256

            a486d2a0b6b61b32aa9c2656cf3bc41f4e52e8a9e42d1acc3d4ded6799d7bed7

            SHA512

            453b6478100234d470e1c9cd340424482d31e7aba931494a044278160efb48017983d3982b64100f7c6ae462f5f01136f3b80cc39dea32b66aff0f1d0e746fb3

          • memory/568-101-0x0000000000250000-0x0000000000251000-memory.dmp

            Filesize

            4KB

          • memory/812-79-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-76-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-75-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-78-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-80-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-84-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-77-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-83-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-82-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-81-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-85-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/812-74-0x0000000000310000-0x0000000000311000-memory.dmp

            Filesize

            4KB

          • memory/2444-15-0x0000000000370000-0x0000000000399000-memory.dmp

            Filesize

            164KB

          • memory/2444-9-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-6-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-5-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-4-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-2-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-28-0x0000000000370000-0x0000000000399000-memory.dmp

            Filesize

            164KB

          • memory/2444-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-11-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-19-0x0000000000370000-0x0000000000399000-memory.dmp

            Filesize

            164KB

          • memory/2444-8-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-7-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-10-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-12-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-13-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-14-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2444-17-0x0000000000400000-0x0000000000472000-memory.dmp

            Filesize

            456KB

          • memory/2444-18-0x00000000002F0000-0x00000000002F1000-memory.dmp

            Filesize

            4KB

          • memory/2544-55-0x0000000010000000-0x000000001001E000-memory.dmp

            Filesize

            120KB

          • memory/2544-60-0x0000000000060000-0x0000000000061000-memory.dmp

            Filesize

            4KB

          • memory/2544-56-0x0000000010000000-0x000000001001E000-memory.dmp

            Filesize

            120KB

          • memory/2632-54-0x0000000002660000-0x0000000002661000-memory.dmp

            Filesize

            4KB

          • memory/2632-38-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-37-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-36-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-35-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-39-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-40-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-41-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-42-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-43-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-46-0x0000000000400000-0x0000000000472000-memory.dmp

            Filesize

            456KB

          • memory/2632-47-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-48-0x0000000002480000-0x00000000024A9000-memory.dmp

            Filesize

            164KB

          • memory/2632-49-0x0000000010000000-0x0000000010007000-memory.dmp

            Filesize

            28KB

          • memory/2632-50-0x0000000010000000-0x0000000010007000-memory.dmp

            Filesize

            28KB

          • memory/2632-61-0x0000000002480000-0x00000000024A9000-memory.dmp

            Filesize

            164KB

          • memory/2632-34-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-33-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2632-32-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB