Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
3386773652cab6d42e5eb77f33b414c2.exe
Resource
win7-20240221-en
General
-
Target
3386773652cab6d42e5eb77f33b414c2.exe
-
Size
617KB
-
MD5
3386773652cab6d42e5eb77f33b414c2
-
SHA1
46af3a4f285a71a1f27b67e79359d980612226b4
-
SHA256
6bedede89d5da863ed511594e3fb7c5e18a113ccdbd0f8d7611bcfe61f59641d
-
SHA512
cd6f3a152ae82ea19686f83d26eac06e888dfe753bb8fc863570a2a1a6db3b9c5fedf910b71e2d40886c07d650c4b35faf69c1f322560bc67539728b9aceb7c2
-
SSDEEP
12288:l2iKVaUqdJS4Vo5pLRpHiANQ6elKQI64i55oc:Y+UgSckQ61Qd4iToc
Malware Config
Extracted
lokibot
http://namex-na.com/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2980 powershell.exe 3216 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 3386773652cab6d42e5eb77f33b414c2.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vbc.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook vbc.exe Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 224 set thread context of 3996 224 3386773652cab6d42e5eb77f33b414c2.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3984 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 224 3386773652cab6d42e5eb77f33b414c2.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 2980 powershell.exe 3216 powershell.exe 2980 powershell.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 224 3386773652cab6d42e5eb77f33b414c2.exe 3216 powershell.exe 224 3386773652cab6d42e5eb77f33b414c2.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 224 3386773652cab6d42e5eb77f33b414c2.exe Token: SeDebugPrivilege 2980 powershell.exe Token: SeDebugPrivilege 3216 powershell.exe Token: SeDebugPrivilege 3996 vbc.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 224 wrote to memory of 2980 224 3386773652cab6d42e5eb77f33b414c2.exe 92 PID 224 wrote to memory of 2980 224 3386773652cab6d42e5eb77f33b414c2.exe 92 PID 224 wrote to memory of 2980 224 3386773652cab6d42e5eb77f33b414c2.exe 92 PID 224 wrote to memory of 3216 224 3386773652cab6d42e5eb77f33b414c2.exe 94 PID 224 wrote to memory of 3216 224 3386773652cab6d42e5eb77f33b414c2.exe 94 PID 224 wrote to memory of 3216 224 3386773652cab6d42e5eb77f33b414c2.exe 94 PID 224 wrote to memory of 3984 224 3386773652cab6d42e5eb77f33b414c2.exe 96 PID 224 wrote to memory of 3984 224 3386773652cab6d42e5eb77f33b414c2.exe 96 PID 224 wrote to memory of 3984 224 3386773652cab6d42e5eb77f33b414c2.exe 96 PID 224 wrote to memory of 1620 224 3386773652cab6d42e5eb77f33b414c2.exe 98 PID 224 wrote to memory of 1620 224 3386773652cab6d42e5eb77f33b414c2.exe 98 PID 224 wrote to memory of 1620 224 3386773652cab6d42e5eb77f33b414c2.exe 98 PID 224 wrote to memory of 4908 224 3386773652cab6d42e5eb77f33b414c2.exe 99 PID 224 wrote to memory of 4908 224 3386773652cab6d42e5eb77f33b414c2.exe 99 PID 224 wrote to memory of 4908 224 3386773652cab6d42e5eb77f33b414c2.exe 99 PID 224 wrote to memory of 2192 224 3386773652cab6d42e5eb77f33b414c2.exe 100 PID 224 wrote to memory of 2192 224 3386773652cab6d42e5eb77f33b414c2.exe 100 PID 224 wrote to memory of 2192 224 3386773652cab6d42e5eb77f33b414c2.exe 100 PID 224 wrote to memory of 3996 224 3386773652cab6d42e5eb77f33b414c2.exe 101 PID 224 wrote to memory of 3996 224 3386773652cab6d42e5eb77f33b414c2.exe 101 PID 224 wrote to memory of 3996 224 3386773652cab6d42e5eb77f33b414c2.exe 101 PID 224 wrote to memory of 3996 224 3386773652cab6d42e5eb77f33b414c2.exe 101 PID 224 wrote to memory of 3996 224 3386773652cab6d42e5eb77f33b414c2.exe 101 PID 224 wrote to memory of 3996 224 3386773652cab6d42e5eb77f33b414c2.exe 101 PID 224 wrote to memory of 3996 224 3386773652cab6d42e5eb77f33b414c2.exe 101 PID 224 wrote to memory of 3996 224 3386773652cab6d42e5eb77f33b414c2.exe 101 PID 224 wrote to memory of 3996 224 3386773652cab6d42e5eb77f33b414c2.exe 101 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook vbc.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3386773652cab6d42e5eb77f33b414c2.exe"C:\Users\Admin\AppData\Local\Temp\3386773652cab6d42e5eb77f33b414c2.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3386773652cab6d42e5eb77f33b414c2.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZFDfJPJOzHNzUJ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3216
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZFDfJPJOzHNzUJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp947F.tmp"2⤵
- Creates scheduled task(s)
PID:3984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:1620
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:4908
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2192
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD54c7656a935204f1d0e6f934b6ce81088
SHA108849f31c07687e9fa4e0de57d3169fc5a327f3d
SHA2564c4fa9924c0aa678698d1a2954a557cbe65dd116d88cf93d45183f5491249a31
SHA5124b3a35dd7d836ca6987ccff1b160012ee2ae92775a272b3b1f2ec48aa4ceb1129de6863face2c229e4a410f35880ac7ca09a5c4c9dd81b194826dc9223ff2e4d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD537ad9e4d86e39012d07d73fb528b24fc
SHA1740c1f8f634298167014d3689ae152ca1aa7fef0
SHA2567e96e406e9ae415e2af4dbd41ae8a0511fae3ccd5f18d4d0157b55a1afb521b2
SHA512c97c51c510b329ed3d987e2b4e2ca524c9695cce1aef0d8fd192c796b1981fcc2966c9d181cb09f7c8ffddb98b52725cb16d5bbdcdfb3ab4e542d9566134b0a0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3906287020-2915474608-1755617787-1000\0f5007522459c86e95ffcc62f32308f1_215f2dba-ef84-4dd1-b127-5f514a0c233b
Filesize46B
MD5c07225d4e7d01d31042965f048728a0a
SHA169d70b340fd9f44c89adb9a2278df84faa9906b7
SHA2568c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA51223d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3906287020-2915474608-1755617787-1000\0f5007522459c86e95ffcc62f32308f1_215f2dba-ef84-4dd1-b127-5f514a0c233b
Filesize46B
MD5d898504a722bff1524134c6ab6a5eaa5
SHA1e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA51226a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61