Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/09/2024, 13:53

240926-q6358szhjn 10

18/09/2024, 09:53

240918-lwmnaavaje 9

Analysis

  • max time kernel
    94s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/09/2024, 13:53

General

  • Target

    3d6066fa56bb2fc7775123fc717744b49f7d48ad2b44349d1d42d5048356e437.exe

  • Size

    76KB

  • MD5

    7a47db5c25aaae2b0772c78f70983681

  • SHA1

    d9994e6210e4ba1eaf210a43453143ed8011ef87

  • SHA256

    3d6066fa56bb2fc7775123fc717744b49f7d48ad2b44349d1d42d5048356e437

  • SHA512

    8c114069e1d207c86a299fcbb3120c1d22e70a9233ab05a9faf5c1dbd15cf293e54241b2a710241791942ee9ee7f46729d8d4f54ba4ac634b54b3ec7c8ddbd32

  • SSDEEP

    1536:AdRlBEByBQBFDz+oBLBvOBSBlB+2xq0uEYqLIm08TIVVtDKsh6:QlBEByBQBdz+oBLBGBSBlBRxq09FvfTX

Malware Config

Signatures

  • Detects Obj3ctivity Stage1 2 IoCs

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

  • Obj3ctivity, PXRECVOWEIWOEI

    Obj3ctivity aka PXRECVOWEIWOEI is an infostealer written in C#.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d6066fa56bb2fc7775123fc717744b49f7d48ad2b44349d1d42d5048356e437.exe
    "C:\Users\Admin\AppData\Local\Temp\3d6066fa56bb2fc7775123fc717744b49f7d48ad2b44349d1d42d5048356e437.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:4676
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Wi-Fi Discovery
      • Suspicious use of WriteProcessMemory
      PID:3184
      • C:\Windows\SysWOW64\chcp.com
        chcp 65001
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4836
      • C:\Windows\SysWOW64\netsh.exe
        netsh wlan show profile
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:2500
      • C:\Windows\SysWOW64\findstr.exe
        findstr All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:932
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4676-0-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

    Filesize

    4KB

  • memory/4676-1-0x00000000000F0000-0x000000000010A000-memory.dmp

    Filesize

    104KB

  • memory/4676-2-0x0000000074C50000-0x0000000075400000-memory.dmp

    Filesize

    7.7MB

  • memory/4676-3-0x00000000055A0000-0x0000000005686000-memory.dmp

    Filesize

    920KB

  • memory/4676-4-0x0000000005800000-0x0000000005866000-memory.dmp

    Filesize

    408KB

  • memory/4676-5-0x00000000062D0000-0x00000000062E2000-memory.dmp

    Filesize

    72KB

  • memory/4676-6-0x00000000065C0000-0x0000000006782000-memory.dmp

    Filesize

    1.8MB

  • memory/4676-36-0x00000000064F0000-0x0000000006566000-memory.dmp

    Filesize

    472KB

  • memory/4676-58-0x0000000006F40000-0x00000000074E4000-memory.dmp

    Filesize

    5.6MB

  • memory/4676-59-0x0000000006890000-0x0000000006922000-memory.dmp

    Filesize

    584KB

  • memory/4676-60-0x0000000074C5E000-0x0000000074C5F000-memory.dmp

    Filesize

    4KB

  • memory/4676-61-0x0000000074C50000-0x0000000075400000-memory.dmp

    Filesize

    7.7MB

  • memory/4676-62-0x00000000074F0000-0x0000000007A1C000-memory.dmp

    Filesize

    5.2MB

  • memory/4676-64-0x0000000074C50000-0x0000000075400000-memory.dmp

    Filesize

    7.7MB