Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22/05/2024, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
Obavestenje o prilivu.PDF.exe
Resource
win7-20240508-en
General
-
Target
Obavestenje o prilivu.PDF.exe
-
Size
524KB
-
MD5
3911e099bed114b7417378e2dbe079d1
-
SHA1
00fea996bbff2b686a0b3e275d536babacefc0af
-
SHA256
e9e09c2f8031763a0c8494d500bd28ca3adc87d5f700111255db99f8142f2933
-
SHA512
55630fbf32fb702185fbc3f6adee9f5775e6e91c0c1bf9e448d7506ebed15852970946d856d9dd399f0b12da3f0a97a05c6c2803a4546e8a034e8f89eeb3694b
-
SSDEEP
12288:7EELYhiWgZlgyCGYRe6v/M1Kx5pPKYcfzvw:oEskWgDDyb01I5pPKvfr
Malware Config
Extracted
lokibot
http://45.61.137.215/index.php/3b1tenbkyj
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3052 powershell.exe 2400 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2740 gJUOIrUR6kc2sEM.exe -
Loads dropped DLL 6 IoCs
pid Process 2416 Obavestenje o prilivu.PDF.exe 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe 2768 WerFault.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2416 set thread context of 2696 2416 Obavestenje o prilivu.PDF.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2768 2740 WerFault.exe 30 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3052 powershell.exe 2740 gJUOIrUR6kc2sEM.exe 2740 gJUOIrUR6kc2sEM.exe 2400 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2416 Obavestenje o prilivu.PDF.exe Token: SeDebugPrivilege 3052 powershell.exe Token: SeDebugPrivilege 2696 RegSvcs.exe Token: SeDebugPrivilege 2740 gJUOIrUR6kc2sEM.exe Token: SeDebugPrivilege 2400 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2416 wrote to memory of 3052 2416 Obavestenje o prilivu.PDF.exe 28 PID 2416 wrote to memory of 3052 2416 Obavestenje o prilivu.PDF.exe 28 PID 2416 wrote to memory of 3052 2416 Obavestenje o prilivu.PDF.exe 28 PID 2416 wrote to memory of 3052 2416 Obavestenje o prilivu.PDF.exe 28 PID 2416 wrote to memory of 2740 2416 Obavestenje o prilivu.PDF.exe 30 PID 2416 wrote to memory of 2740 2416 Obavestenje o prilivu.PDF.exe 30 PID 2416 wrote to memory of 2740 2416 Obavestenje o prilivu.PDF.exe 30 PID 2416 wrote to memory of 2740 2416 Obavestenje o prilivu.PDF.exe 30 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2416 wrote to memory of 2696 2416 Obavestenje o prilivu.PDF.exe 31 PID 2740 wrote to memory of 2400 2740 gJUOIrUR6kc2sEM.exe 33 PID 2740 wrote to memory of 2400 2740 gJUOIrUR6kc2sEM.exe 33 PID 2740 wrote to memory of 2400 2740 gJUOIrUR6kc2sEM.exe 33 PID 2740 wrote to memory of 2400 2740 gJUOIrUR6kc2sEM.exe 33 PID 2740 wrote to memory of 2768 2740 gJUOIrUR6kc2sEM.exe 35 PID 2740 wrote to memory of 2768 2740 gJUOIrUR6kc2sEM.exe 35 PID 2740 wrote to memory of 2768 2740 gJUOIrUR6kc2sEM.exe 35 PID 2740 wrote to memory of 2768 2740 gJUOIrUR6kc2sEM.exe 35 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Obavestenje o prilivu.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Obavestenje o prilivu.PDF.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Obavestenje o prilivu.PDF.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052
-
-
C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 8803⤵
- Loads dropped DLL
- Program crash
PID:2768
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3691908287-3775019229-3534252667-1000\0f5007522459c86e95ffcc62f32308f1_a42634aa-f501-41cf-bed1-b8158857da02
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3691908287-3775019229-3534252667-1000\0f5007522459c86e95ffcc62f32308f1_a42634aa-f501-41cf-bed1-b8158857da02
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5e77aa445e051d3bc88d6443707b33632
SHA1015f0831b70fb7fd83bbdc6cb0ec4af83ad85172
SHA25634c437aaada60dd91eea4af554df4c66e1df0608426a4e36ff8b04bfa96d341a
SHA51286c295acf2e36563602a36f8a1574cc26b26ae5381c1a843c8aab4985ef97515fa7c7ceda89af214d42d1dd69167ddac76745198664b02f8541bbc1b7e9ae5f5
-
Filesize
615KB
MD59fb018d34d80db3b22e721e2768f6bb5
SHA1bba13f32dc03ba024b55a76e92137dec699640cc
SHA2568ef8e3afba42a19e43c2cb6f591ad6ef601791db37b5626f6102e6c4d39667b7
SHA5127f8a28f648b48bbbabdb7c7d78329fe821a11a54b40ed921be460c9875ba02307535cb0847dcf055497978e360f754083b67bc18877c6d6f2cb6b34aa1b3c2a2