Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2024, 22:10

General

  • Target

    61e48789ffe85d3f4ad3a4b35888db4760d2cac61f032befe8284f94b32684aa.exe

  • Size

    292KB

  • MD5

    cd2867400d86adf084a13deec86d2c39

  • SHA1

    92263b1eef5d2e25cfb0c5060f3b9e25cd69779f

  • SHA256

    61e48789ffe85d3f4ad3a4b35888db4760d2cac61f032befe8284f94b32684aa

  • SHA512

    3b6225ea43362c8c468f3bf37cd2365ae447efe7c1a347504ef10aeead0e0c602f5bae3270efe738ee82630880a4b8637904c484eabd85eb22670764f4479d4b

  • SSDEEP

    3072:Aw2bSHEENJRNgwkvXKATeyRhJLcXm65tz3CnfBpg23ic9gvL4Z:L2bNWJRz2Xnh+H5t7CnJp7uj4

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • Creates new service(s) 2 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61e48789ffe85d3f4ad3a4b35888db4760d2cac61f032befe8284f94b32684aa.exe
    "C:\Users\Admin\AppData\Local\Temp\61e48789ffe85d3f4ad3a4b35888db4760d2cac61f032befe8284f94b32684aa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yrfrfckq\
      2⤵
        PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xrrjmwam.exe" C:\Windows\SysWOW64\yrfrfckq\
        2⤵
          PID:2920
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create yrfrfckq binPath= "C:\Windows\SysWOW64\yrfrfckq\xrrjmwam.exe /d\"C:\Users\Admin\AppData\Local\Temp\61e48789ffe85d3f4ad3a4b35888db4760d2cac61f032befe8284f94b32684aa.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2216
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description yrfrfckq "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2316
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start yrfrfckq
          2⤵
          • Launches sc.exe
          PID:2436
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2788
      • C:\Windows\SysWOW64\yrfrfckq\xrrjmwam.exe
        C:\Windows\SysWOW64\yrfrfckq\xrrjmwam.exe /d"C:\Users\Admin\AppData\Local\Temp\61e48789ffe85d3f4ad3a4b35888db4760d2cac61f032befe8284f94b32684aa.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2656
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:2368

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\xrrjmwam.exe

        Filesize

        13.9MB

        MD5

        e38961370e5a52772e0e500ae5e60244

        SHA1

        2c28d01637f8f231a7a4dfe6ab6c3e67760a4746

        SHA256

        a218affed8f7d099f9f0c19fdb1ea55b7ef73f01afd3e0c08ca0703e04e6622a

        SHA512

        a5922eb2ae9e79fdeb3551dfe5ca9e0e3ca6678ee72d40eef06e851a3625fe80c9ec0918cc35f92b28d6cd4b9f6964363aad54bd8ed1ef98c5f951a9f5f0ed37

      • memory/2280-2-0x0000000000220000-0x0000000000233000-memory.dmp

        Filesize

        76KB

      • memory/2280-3-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/2280-1-0x0000000002570000-0x0000000002670000-memory.dmp

        Filesize

        1024KB

      • memory/2280-10-0x0000000002570000-0x0000000002670000-memory.dmp

        Filesize

        1024KB

      • memory/2280-9-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/2280-8-0x0000000000400000-0x0000000002462000-memory.dmp

        Filesize

        32.4MB

      • memory/2368-47-0x0000000000130000-0x0000000000135000-memory.dmp

        Filesize

        20KB

      • memory/2368-43-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-18-0x0000000000080000-0x0000000000095000-memory.dmp

        Filesize

        84KB

      • memory/2368-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2368-11-0x0000000000080000-0x0000000000095000-memory.dmp

        Filesize

        84KB

      • memory/2368-23-0x0000000001A00000-0x0000000001C0F000-memory.dmp

        Filesize

        2.1MB

      • memory/2368-20-0x0000000001A00000-0x0000000001C0F000-memory.dmp

        Filesize

        2.1MB

      • memory/2368-50-0x0000000000130000-0x0000000000135000-memory.dmp

        Filesize

        20KB

      • memory/2368-55-0x0000000000140000-0x0000000000147000-memory.dmp

        Filesize

        28KB

      • memory/2368-54-0x0000000005500000-0x000000000590B000-memory.dmp

        Filesize

        4.0MB

      • memory/2368-51-0x0000000005500000-0x000000000590B000-memory.dmp

        Filesize

        4.0MB

      • memory/2368-17-0x0000000000080000-0x0000000000095000-memory.dmp

        Filesize

        84KB

      • memory/2368-46-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-45-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-44-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-14-0x0000000000080000-0x0000000000095000-memory.dmp

        Filesize

        84KB

      • memory/2368-42-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-41-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-40-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-39-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-38-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-37-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-36-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-35-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-34-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-33-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-32-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-31-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-30-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-27-0x0000000000120000-0x0000000000130000-memory.dmp

        Filesize

        64KB

      • memory/2368-24-0x0000000000110000-0x0000000000116000-memory.dmp

        Filesize

        24KB

      • memory/2656-16-0x0000000000400000-0x0000000002462000-memory.dmp

        Filesize

        32.4MB