Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2024, 03:04

General

  • Target

    d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1.exe

  • Size

    79KB

  • MD5

    0c883b1d66afce606d9830f48d69d74b

  • SHA1

    fe431fe73a4749722496f19b3b3ca0b629b50131

  • SHA256

    d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

  • SHA512

    c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

  • SSDEEP

    1536:ZwjmKHFmav82kFifdWXwCsgTT+vr3Rzmxwz6fYc6on:+6tOMFif3CsKavr0xwz6gc6on

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.84

Signatures

  • Phorphiex family
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 12 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1.exe
        "C:\Users\Admin\AppData\Local\Temp\d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\sysnldcvmr.exe
          C:\Windows\sysnldcvmr.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1488
          • C:\Users\Admin\AppData\Local\Temp\2860527786.exe
            C:\Users\Admin\AppData\Local\Temp\2860527786.exe
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2344
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2936
              • C:\Windows\system32\reg.exe
                reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                6⤵
                  PID:2476
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3060
                • C:\Windows\system32\schtasks.exe
                  schtasks /delete /f /tn "Windows Upgrade Manager"
                  6⤵
                    PID:2824
              • C:\Users\Admin\AppData\Local\Temp\2524215754.exe
                C:\Users\Admin\AppData\Local\Temp\2524215754.exe
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2732
                • C:\Users\Admin\AppData\Local\Temp\1853938558.exe
                  C:\Users\Admin\AppData\Local\Temp\1853938558.exe
                  5⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2928
              • C:\Users\Admin\AppData\Local\Temp\111303719.exe
                C:\Users\Admin\AppData\Local\Temp\111303719.exe
                4⤵
                • Executes dropped EXE
                PID:3052
              • C:\Users\Admin\AppData\Local\Temp\1625625115.exe
                C:\Users\Admin\AppData\Local\Temp\1625625115.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2592
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2864
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2896
          • C:\Windows\System32\schtasks.exe
            C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
            2⤵
              PID:1940
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:544
              • C:\Windows\system32\schtasks.exe
                "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:472
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe
              2⤵
                PID:840
              • C:\Windows\System32\dwm.exe
                C:\Windows\System32\dwm.exe
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2336
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {E18BE1A9-66A2-433F-BDAD-D97F7F44D1DD} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]
              1⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2312
              • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
                "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
                2⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1876

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

              Filesize

              7KB

              MD5

              8eabe5d262df4c1c9afa1586eddff155

              SHA1

              6407de911a7d2884b3b47748182adc59a83d1d3e

              SHA256

              131c355d80b7d5ce55b36968cd682550107cac594e62b226e7b8793e2b943e7b

              SHA512

              13f6cc10aa784b7e5f619b9df038a351a42831cdc20442f7fa426d5b4ef016ff8ac39727058388542209dc26b2be50ba4229648c8f8d82ee42fac37c3351e86c

            • C:\Windows\sysnldcvmr.exe

              Filesize

              79KB

              MD5

              0c883b1d66afce606d9830f48d69d74b

              SHA1

              fe431fe73a4749722496f19b3b3ca0b629b50131

              SHA256

              d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

              SHA512

              c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

            • \Users\Admin\AppData\Local\Temp\111303719.exe

              Filesize

              53KB

              MD5

              84897ca8c1aa06b33248956ac25ec20a

              SHA1

              544d5d5652069b3c5e7e29a1ca3eea46b227bbfe

              SHA256

              023ad16f761a35bd7934e392bcf2bbf702f525303b2964e97c3e50d2d5f3eda1

              SHA512

              c17d0e364cf29055dece3e10896f0bbd0ebdb8d2b1c15fe68ddcd9951dd2d1545362f45ad21f26302f3da2eb2ec81340a027cbd4c75cc28491151ecabae65e95

            • \Users\Admin\AppData\Local\Temp\1625625115.exe

              Filesize

              61KB

              MD5

              77c5eb90118287f666886fc34210c176

              SHA1

              d7a59bf4f014304e29df1868ef82fe782432120a

              SHA256

              59a96d66d97e202829ea79a5e0bbf71981c05a13ab700b0120f7d99d33515080

              SHA512

              5577d167ad4748ad7917ff3f792a0caa01ba40638bdf7143c1403d2efcad4019f8da49719ae0ad88febdc1ef64207fba7ca5bb96dc12c334571d30e2e8f22cf9

            • \Users\Admin\AppData\Local\Temp\1853938558.exe

              Filesize

              5.6MB

              MD5

              13b26b2c7048a92d6a843c1302618fad

              SHA1

              89c2dfc01ac12ef2704c7669844ec69f1700c1ca

              SHA256

              1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

              SHA512

              d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

            • \Users\Admin\AppData\Local\Temp\2524215754.exe

              Filesize

              10KB

              MD5

              96509ab828867d81c1693b614b22f41d

              SHA1

              c5f82005dbda43cedd86708cc5fc3635a781a67e

              SHA256

              a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

              SHA512

              ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

            • \Users\Admin\AppData\Local\Temp\2860527786.exe

              Filesize

              8KB

              MD5

              cb8420e681f68db1bad5ed24e7b22114

              SHA1

              416fc65d538d3622f5ca71c667a11df88a927c31

              SHA256

              5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

              SHA512

              baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

            • memory/544-64-0x0000000002260000-0x0000000002268000-memory.dmp

              Filesize

              32KB

            • memory/544-63-0x000000001B540000-0x000000001B822000-memory.dmp

              Filesize

              2.9MB

            • memory/840-76-0x0000000140000000-0x0000000140029000-memory.dmp

              Filesize

              164KB

            • memory/840-73-0x0000000140000000-0x0000000140029000-memory.dmp

              Filesize

              164KB

            • memory/1876-68-0x000000013F1D0000-0x000000013F767000-memory.dmp

              Filesize

              5.6MB

            • memory/1876-70-0x000000013F1D0000-0x000000013F767000-memory.dmp

              Filesize

              5.6MB

            • memory/2336-79-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2336-83-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2336-71-0x0000000000230000-0x0000000000250000-memory.dmp

              Filesize

              128KB

            • memory/2336-94-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2336-92-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2336-75-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2336-90-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2336-77-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2336-88-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2336-81-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2336-85-0x0000000140000000-0x00000001407EF000-memory.dmp

              Filesize

              7.9MB

            • memory/2344-15-0x000007FEF4E33000-0x000007FEF4E34000-memory.dmp

              Filesize

              4KB

            • memory/2344-16-0x000000013F980000-0x000000013F986000-memory.dmp

              Filesize

              24KB

            • memory/2864-42-0x000000001B510000-0x000000001B7F2000-memory.dmp

              Filesize

              2.9MB

            • memory/2864-43-0x00000000022D0000-0x00000000022D8000-memory.dmp

              Filesize

              32KB

            • memory/2928-46-0x000000013FE90000-0x0000000140427000-memory.dmp

              Filesize

              5.6MB