Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 19:02

General

  • Target

    dab687d0562daae2c789f4ee10c3d440N.exe

  • Size

    113KB

  • MD5

    dab687d0562daae2c789f4ee10c3d440

  • SHA1

    5171bb133961d258fa38c4a48481cbc0e5960d2e

  • SHA256

    a32ef391573926562422a7dd7547429114258f4c6e530caa0a578d78d6c76058

  • SHA512

    22319aaca532123e17a48053b3bd416c66d6b333c82e5dab407e4719a42c3b6ad6293186bbdc7b470d83cae3fe1a3bff8ccb53617183d56f8ab6e5e5589ae6ad

  • SSDEEP

    3072:OVS1/eI4pnTfEFYJE3nwzPdCNU/efHYTo+:OEHGnTcFYOXwJigT

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3

Attributes
  • mutex

    x88767657x

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 7 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3544
      • C:\Users\Admin\AppData\Local\Temp\dab687d0562daae2c789f4ee10c3d440N.exe
        "C:\Users\Admin\AppData\Local\Temp\dab687d0562daae2c789f4ee10c3d440N.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Users\Admin\AppData\Local\Temp\8A8D.exe
          "C:\Users\Admin\AppData\Local\Temp\8A8D.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\Users\Admin\AppData\Local\Temp\2881922775.exe
            C:\Users\Admin\AppData\Local\Temp\2881922775.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4804
            • C:\Windows\sysmysldrv.exe
              C:\Windows\sysmysldrv.exe
              5⤵
              • Modifies security service
              • Windows security bypass
              • Checks computer location settings
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3184
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4200
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:904
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4076
                • C:\Windows\SysWOW64\sc.exe
                  sc stop UsoSvc
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:4324
                • C:\Windows\SysWOW64\sc.exe
                  sc stop WaaSMedicSvc
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:4880
                • C:\Windows\SysWOW64\sc.exe
                  sc stop wuauserv
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:3852
                • C:\Windows\SysWOW64\sc.exe
                  sc stop DoSvc
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:2092
                • C:\Windows\SysWOW64\sc.exe
                  sc stop BITS
                  7⤵
                  • Launches sc.exe
                  • System Location Discovery: System Language Discovery
                  PID:1680
              • C:\Users\Admin\AppData\Local\Temp\2094227408.exe
                C:\Users\Admin\AppData\Local\Temp\2094227408.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4100
              • C:\Users\Admin\AppData\Local\Temp\2470919132.exe
                C:\Users\Admin\AppData\Local\Temp\2470919132.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4328
              • C:\Users\Admin\AppData\Local\Temp\1168826113.exe
                C:\Users\Admin\AppData\Local\Temp\1168826113.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2636
                • C:\Users\Admin\AppData\Local\Temp\1250119744.exe
                  C:\Users\Admin\AppData\Local\Temp\1250119744.exe
                  7⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2120
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:220
      • C:\Windows\System32\schtasks.exe
        C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
        2⤵
          PID:3688
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4488
        • C:\Windows\System32\notepad.exe
          C:\Windows\System32\notepad.exe
          2⤵
            PID:4516
        • C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
          "C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
          1⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2180

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          3KB

          MD5

          fee026663fcb662152188784794028ee

          SHA1

          3c02a26a9cb16648fad85c6477b68ced3cb0cb45

          SHA256

          dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b

          SHA512

          7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          d95b08252ed624f6d91b46523f110f29

          SHA1

          17577997bc1fb5d3fbe59be84013165534415dc3

          SHA256

          342ce7c39bf9992d31d4b61ef138b2b084c96c74736ed00bb19aae49be16ca02

          SHA512

          0c4288176d56f4ee6d8f08f568fba07ad859f50a395c39d2afd3baf55d3d29ca065a1ce305d1bd790477c35977c0ffa230543e805622f80a77bcee71b24eb257

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          23c8f15ed37c01aefc2b72e1ff53ead7

          SHA1

          62f1d9f45e61b1e96ed0325af4a31e623911f885

          SHA256

          697fe38bca7d113a67cde2c718a1bc23227a0a16c878d6667b734ca24e0452f1

          SHA512

          c4440b6d78dfa8d8ca6835cdffcd1e305f23d8eb1f9e662e38a46cfc9a98c01811a9ad1605043207a4b65d2ec630b1fec0a8a114ea2d8258c66c7523082073c3

        • C:\Users\Admin\AppData\Local\Temp\1168826113.exe

          Filesize

          10KB

          MD5

          4fe8dc617311f7b6a4b8ebe0b1e24090

          SHA1

          2bd9341f17c8c0c62e56e1863b1d2f9c43cb30e5

          SHA256

          5016e413b0c563efc920165e7235c9f2706808877668bd297b41435acc7aade4

          SHA512

          910a12fbaffd45b0f797a95c6678a32c4a27adbb7d1474f183f8863d310d31fbba17d5d747da87ac4a30dd7cb22c67a4d1c25b302ef0c3f6954d91a459c692db

        • C:\Users\Admin\AppData\Local\Temp\1250119744.exe

          Filesize

          5.4MB

          MD5

          41ab08c1955fce44bfd0c76a64d1945a

          SHA1

          2b9cb05f4de5d98c541d15175d7f0199cbdd0eea

          SHA256

          dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493

          SHA512

          38834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116

        • C:\Users\Admin\AppData\Local\Temp\2094227408.exe

          Filesize

          7KB

          MD5

          af0622340ed8ba48efa92e0b2d9aca7b

          SHA1

          77e7181b4d4e6957cf13ba37f590cf219aac88cb

          SHA256

          7b7d433c6c204ed3bcd1ea74106592edfa1a30b6ef7bbc3ed21efcbadc51e526

          SHA512

          e1368c1c292789115b51cae549bd2d484dbc614eb3e57aa5fce324385d28e9fbddf60064b4c88237b38cded294d090d07c491b646651c45bcd6235630d94ef46

        • C:\Users\Admin\AppData\Local\Temp\2881922775.exe

          Filesize

          92KB

          MD5

          be9388b42333b3d4e163b0ace699897b

          SHA1

          4e1109772eb9cb59c557380822166fe1664403bd

          SHA256

          d281e0a0f1e1073f2d290a7eb1f77bed4c210dbf83a0f4f4e22073f50faa843f

          SHA512

          5f887f1060b898c9a88745cde7cf509fdf42947ab8e5948b46c2df659468dc245b24d089bdbec0b314c40b83934698bf4b6feb8954e32810ff8f522aab0af19a

        • C:\Users\Admin\AppData\Local\Temp\8A8D.exe

          Filesize

          9KB

          MD5

          8d8e6c7952a9dc7c0c73911c4dbc5518

          SHA1

          9098da03b33b2c822065b49d5220359c275d5e94

          SHA256

          feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

          SHA512

          91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzavjeyl.zdj.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/220-85-0x00000260D8480000-0x00000260D84A2000-memory.dmp

          Filesize

          136KB

        • memory/904-33-0x00000000065D0000-0x000000000661C000-memory.dmp

          Filesize

          304KB

        • memory/904-31-0x0000000005F80000-0x00000000062D4000-memory.dmp

          Filesize

          3.3MB

        • memory/904-35-0x000000006FB10000-0x000000006FB5C000-memory.dmp

          Filesize

          304KB

        • memory/904-45-0x0000000006B90000-0x0000000006BAE000-memory.dmp

          Filesize

          120KB

        • memory/904-46-0x00000000077B0000-0x0000000007853000-memory.dmp

          Filesize

          652KB

        • memory/904-47-0x0000000007F70000-0x00000000085EA000-memory.dmp

          Filesize

          6.5MB

        • memory/904-48-0x00000000078F0000-0x000000000790A000-memory.dmp

          Filesize

          104KB

        • memory/904-49-0x0000000007940000-0x000000000794A000-memory.dmp

          Filesize

          40KB

        • memory/904-50-0x0000000007B50000-0x0000000007BE6000-memory.dmp

          Filesize

          600KB

        • memory/904-51-0x0000000007AF0000-0x0000000007B01000-memory.dmp

          Filesize

          68KB

        • memory/904-52-0x0000000007B10000-0x0000000007B1E000-memory.dmp

          Filesize

          56KB

        • memory/904-53-0x0000000007B20000-0x0000000007B34000-memory.dmp

          Filesize

          80KB

        • memory/904-54-0x0000000007C10000-0x0000000007C2A000-memory.dmp

          Filesize

          104KB

        • memory/904-55-0x0000000007BF0000-0x0000000007BF8000-memory.dmp

          Filesize

          32KB

        • memory/904-32-0x0000000006590000-0x00000000065AE000-memory.dmp

          Filesize

          120KB

        • memory/904-34-0x0000000007570000-0x00000000075A2000-memory.dmp

          Filesize

          200KB

        • memory/904-21-0x0000000005D50000-0x0000000005DB6000-memory.dmp

          Filesize

          408KB

        • memory/904-20-0x0000000005680000-0x00000000056E6000-memory.dmp

          Filesize

          408KB

        • memory/904-19-0x00000000055E0000-0x0000000005602000-memory.dmp

          Filesize

          136KB

        • memory/904-17-0x0000000005000000-0x0000000005036000-memory.dmp

          Filesize

          216KB

        • memory/904-18-0x0000000005720000-0x0000000005D48000-memory.dmp

          Filesize

          6.2MB

        • memory/2120-98-0x00007FF608F90000-0x00007FF609506000-memory.dmp

          Filesize

          5.5MB

        • memory/2180-114-0x00007FF7D0B80000-0x00007FF7D10F6000-memory.dmp

          Filesize

          5.5MB

        • memory/4516-115-0x000002564B380000-0x000002564B3A0000-memory.dmp

          Filesize

          128KB

        • memory/4516-116-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp

          Filesize

          7.9MB

        • memory/4516-118-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp

          Filesize

          7.9MB

        • memory/4516-119-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp

          Filesize

          7.9MB

        • memory/4516-120-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp

          Filesize

          7.9MB

        • memory/4516-121-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp

          Filesize

          7.9MB

        • memory/4516-122-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp

          Filesize

          7.9MB