Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 11:25

General

  • Target

    984e4882472dabfc8167797071a0f1b0N.exe

  • Size

    372KB

  • MD5

    984e4882472dabfc8167797071a0f1b0

  • SHA1

    d17ca420d84f78dc50623001483d3e539f5c2147

  • SHA256

    9fe73e028bd1c24d1593652891e835841daa8a5adf6e2fb637c3ff88a404d417

  • SHA512

    5518d94b8adb69ae257821c051cc18ef950e1181f142c28376169ddd67bfc8f8a9dfaad604d1a2f7df2e46549966b4370394a8c725a62a8ed088fc79138b736e

  • SSDEEP

    6144:SEUXnLy2gv7lGl2Z1gABU1JnB5Z6eDYCHzYa/M6wgf:SEUQUHBeAYCHbk6w

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LTK4xdKPAgFHPLan8kriAD7eY4heyy73mB

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4BB7ckkaPTyADc8trtuwDoZxywaR4eNL5cDJ3KBjq9GraN4mUFztf7mLS7WgT7Bh7uPqpjvA4ypVwXKCJ1vvLWWAFvSmDoD

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3BiS1jaRpWtkqtfZGp9f1rXXts5DyUkaBX

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd

Attributes
  • mutex

    dgh345rew

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Signatures

  • Modifies security service 2 TTPs 1 IoCs
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Windows security bypass 2 TTPs 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\984e4882472dabfc8167797071a0f1b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\984e4882472dabfc8167797071a0f1b0N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\AC85.exe
      "C:\Users\Admin\AppData\Local\Temp\AC85.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Users\Admin\AppData\Local\Temp\242119446.exe
        C:\Users\Admin\AppData\Local\Temp\242119446.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\syschvard.exe
          C:\Windows\syschvard.exe
          4⤵
          • Modifies security service
          • Windows security bypass
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2632
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1728
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:768
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1804
            • C:\Windows\SysWOW64\sc.exe
              sc stop UsoSvc
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:1720
            • C:\Windows\SysWOW64\sc.exe
              sc stop WaaSMedicSvc
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:1048
            • C:\Windows\SysWOW64\sc.exe
              sc stop wuauserv
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:1536
            • C:\Windows\SysWOW64\sc.exe
              sc stop DoSvc
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:1240
            • C:\Windows\SysWOW64\sc.exe
              sc stop BITS
              6⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:3004
          • C:\Users\Admin\AppData\Local\Temp\2813212130.exe
            C:\Users\Admin\AppData\Local\Temp\2813212130.exe
            5⤵
            • Executes dropped EXE
            PID:1864

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AC85.exe

    Filesize

    9KB

    MD5

    8d8e6c7952a9dc7c0c73911c4dbc5518

    SHA1

    9098da03b33b2c822065b49d5220359c275d5e94

    SHA256

    feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

    SHA512

    91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

  • \Users\Admin\AppData\Local\Temp\242119446.exe

    Filesize

    84KB

    MD5

    aa63b9c3f01d3d50c77b06c75dd63f88

    SHA1

    e67b74385a1d67ec57f5bb3a40184ee23b251eb4

    SHA256

    dcc51ea4252198d176b3249339675d2ea54759d1fb9aab487bc69f56f7ba2ac1

    SHA512

    0e0445f3158b9501d73d201a64556dfb3db7e513bd2fc32e6b5024d7641ace63679068abdc18a19346a1338a7007ee413ce7861ad09b8db5fb40eef5ec60fda7

  • \Users\Admin\AppData\Local\Temp\2813212130.exe

    Filesize

    10KB

    MD5

    dd4cf1ac2e0fc375ee8b03fd8eb295c8

    SHA1

    0f00590a3be2e22dae8aaaa7391eeb485d45255e

    SHA256

    b04e8d007b3086fab051ae35b11fe16541f0fd4c8e4c2940a35f554ce827c3a4

    SHA512

    cf5b111ce7c9dc45b05994522ce2699d0e8a28fc6d5acdaacfe1f66e5a2b36b9f611a82952a54465702529563c8b5757cfc5625c23635a4005c75e30d691219b