Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
13/07/2024, 07:04
240713-hwfcesshqg 1013/07/2024, 06:54
240713-hn9w3azhnj 1024/08/2023, 07:19
230824-h5hh5sah24 10Analysis
-
max time kernel
226s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
13/07/2024, 07:04
Static task
static1
1 signatures
General
-
Target
xml1.exe
-
Size
396KB
-
MD5
8503ea92f4c9941ee3295978729d98ba
-
SHA1
d04dfbc5b1335c8408ffb5c58bd966791f748ad3
-
SHA256
1e0215f67fb7b02bc44f33bf6a5b884c3061cbeb38e0150b559635458951fa53
-
SHA512
a5dade77d81f3fc49b46d828ea653d55b921e8b65b455dd0a1fa7eba7880b3a86deff0aafd21276a86eb95be948ab61da9771343ccbc24164b31c3a5b18edaa5
-
SSDEEP
6144:omPt4BMS4GhUjjF0CBTTFCIRroPHQJ/s5xi8uwytwnhJCAfYrewWvoKMyDftxQib:ZPt4BMsOvpAHQJ0G8CAfWWvo1im
Malware Config
Extracted
Family
trickbot
Version
1000512
Botnet
xml1
C2
95.171.16.42:443
185.90.61.9:443
5.1.81.68:443
185.99.2.65:443
134.119.191.11:443
85.204.116.100:443
78.108.216.47:443
51.81.112.144:443
194.5.250.121:443
185.14.31.104:443
185.99.2.66:443
107.175.72.141:443
192.3.247.123:443
134.119.191.21:443
85.204.116.216:443
91.235.129.20:443
181.129.104.139:449
181.112.157.42:449
181.129.134.18:449
131.161.253.190:449
121.100.19.18:449
190.136.178.52:449
45.6.16.68:449
110.232.76.39:449
122.50.6.122:449
103.12.161.194:449
36.91.45.10:449
110.93.15.98:449
80.210.32.67:449
103.111.83.246:449
200.107.35.154:449
36.89.182.225:449
36.89.243.241:449
36.92.19.205:449
110.50.84.5:449
182.253.113.67:449
36.66.218.117:449
Attributes
-
autorunName:pwgrab
ecc_pubkey.base64
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: perfmon.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 perfmon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz perfmon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 984 taskmgr.exe 952 perfmon.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 984 taskmgr.exe Token: SeDebugPrivilege 2408 wermgr.exe Token: SeDebugPrivilege 2408 wermgr.exe Token: SeDebugPrivilege 2408 wermgr.exe Token: SeIncBasePriorityPrivilege 984 taskmgr.exe Token: SeDebugPrivilege 952 perfmon.exe Token: SeSystemProfilePrivilege 952 perfmon.exe Token: SeCreateGlobalPrivilege 952 perfmon.exe Token: SeDebugPrivilege 772 wermgr.exe Token: SeDebugPrivilege 772 wermgr.exe Token: SeDebugPrivilege 772 wermgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe 984 taskmgr.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1952 xml1.exe 1952 xml1.exe 1564 xml1.exe 1564 xml1.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2408 1952 xml1.exe 33 PID 1952 wrote to memory of 2408 1952 xml1.exe 33 PID 1952 wrote to memory of 2408 1952 xml1.exe 33 PID 1952 wrote to memory of 2408 1952 xml1.exe 33 PID 1952 wrote to memory of 2408 1952 xml1.exe 33 PID 1952 wrote to memory of 2408 1952 xml1.exe 33 PID 984 wrote to memory of 952 984 taskmgr.exe 34 PID 984 wrote to memory of 952 984 taskmgr.exe 34 PID 984 wrote to memory of 952 984 taskmgr.exe 34 PID 1564 wrote to memory of 772 1564 xml1.exe 36 PID 1564 wrote to memory of 772 1564 xml1.exe 36 PID 1564 wrote to memory of 772 1564 xml1.exe 36 PID 1564 wrote to memory of 772 1564 xml1.exe 36 PID 1564 wrote to memory of 772 1564 xml1.exe 36 PID 1564 wrote to memory of 772 1564 xml1.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\xml1.exe"C:\Users\Admin\AppData\Local\Temp\xml1.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\System32\perfmon.exe"C:\Windows\System32\perfmon.exe" /res2⤵
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
C:\Users\Admin\AppData\Local\Temp\xml1.exe"C:\Users\Admin\AppData\Local\Temp\xml1.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:772
-