Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2024, 06:23

General

  • Target

    2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe

  • Size

    4.6MB

  • MD5

    ef95c78351b1b8efaf2f5483ef7052fd

  • SHA1

    1353ec5c2936ccb1c73a0004f54a35231d6af670

  • SHA256

    d6e6dbcb94ff187fa5275d966b8dec8f67d0e05f2683de719bbd81ddd4e4f7e5

  • SHA512

    277604b19a70eb6c468f36ea679adcf739af1b7ee3c14b85e131e49eb50567d373c322c4204ba935e8140ca696126bcf514934072dcc73e89b1474e1bcd3fcbe

  • SSDEEP

    98304:ZNudyith6XvmDrF45j9NEsCJAvMZCr72ikrweJSDTEiMLHwvDxl+Ji:Z2fth6XvmDrFQh6sCabyrweJ5iEHcDe8

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd

Attributes
  • mutex

    753f85d83d

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

phorphiex

C2

http://185.215.113.84

Signatures

  • Phorphiex family
  • Phorphiex payload 1 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 11 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3544
      • C:\Users\Admin\AppData\Local\Temp\2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe
        "C:\Users\Admin\AppData\Local\Temp\2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2008
        • C:\Users\Admin\AppData\Local\Temp\8491.exe
          "C:\Users\Admin\AppData\Local\Temp\8491.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3008
          • C:\Users\Admin\AppData\Local\Temp\2800317469.exe
            C:\Users\Admin\AppData\Local\Temp\2800317469.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3272
            • C:\Windows\sysnldcvmr.exe
              C:\Windows\sysnldcvmr.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1800
              • C:\Users\Admin\AppData\Local\Temp\2217418379.exe
                C:\Users\Admin\AppData\Local\Temp\2217418379.exe
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1384
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3236
                  • C:\Windows\system32\reg.exe
                    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
                    8⤵
                      PID:2760
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1172
                    • C:\Windows\system32\schtasks.exe
                      schtasks /delete /f /tn "Windows Upgrade Manager"
                      8⤵
                        PID:2888
                  • C:\Users\Admin\AppData\Local\Temp\35876223.exe
                    C:\Users\Admin\AppData\Local\Temp\35876223.exe
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:3968
                    • C:\Users\Admin\AppData\Local\Temp\3383528948.exe
                      C:\Users\Admin\AppData\Local\Temp\3383528948.exe
                      7⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4084
                  • C:\Users\Admin\AppData\Local\Temp\2851726839.exe
                    C:\Users\Admin\AppData\Local\Temp\2851726839.exe
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:4896
                  • C:\Users\Admin\AppData\Local\Temp\1812715143.exe
                    C:\Users\Admin\AppData\Local\Temp\1812715143.exe
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2124
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5056
          • C:\Windows\System32\schtasks.exe
            C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
            2⤵
              PID:4908
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2440
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe
              2⤵
                PID:5024
              • C:\Windows\System32\dwm.exe
                C:\Windows\System32\dwm.exe
                2⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2396
            • C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
              "C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
              1⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:368

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2217418379.exe.log

              Filesize

              425B

              MD5

              fff5cbccb6b31b40f834b8f4778a779a

              SHA1

              899ed0377e89f1ed434cfeecc5bc0163ebdf0454

              SHA256

              b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76

              SHA512

              1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

              Filesize

              3KB

              MD5

              fee026663fcb662152188784794028ee

              SHA1

              3c02a26a9cb16648fad85c6477b68ced3cb0cb45

              SHA256

              dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b

              SHA512

              7b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              1KB

              MD5

              b01828ab5fc1101581eb45e11567d3d2

              SHA1

              bebbc259e2b76600ee5298af7833022336f31224

              SHA256

              398fe8b69e1ecfdef069c367483fbcfd7752cd6f7f227f5eb69aba709075e587

              SHA512

              a77ddb436cc36c8a73862f2e2b8c9e20ffa3c187f4de38a3d390388b76f0028996b5a374302ed8a6796e6e7da0444974dffb9274c4e1bd4972ab2b9645bfeff7

            • C:\Users\Admin\AppData\Local\Temp\1812715143.exe

              Filesize

              61KB

              MD5

              77c5eb90118287f666886fc34210c176

              SHA1

              d7a59bf4f014304e29df1868ef82fe782432120a

              SHA256

              59a96d66d97e202829ea79a5e0bbf71981c05a13ab700b0120f7d99d33515080

              SHA512

              5577d167ad4748ad7917ff3f792a0caa01ba40638bdf7143c1403d2efcad4019f8da49719ae0ad88febdc1ef64207fba7ca5bb96dc12c334571d30e2e8f22cf9

            • C:\Users\Admin\AppData\Local\Temp\2217418379.exe

              Filesize

              8KB

              MD5

              cb8420e681f68db1bad5ed24e7b22114

              SHA1

              416fc65d538d3622f5ca71c667a11df88a927c31

              SHA256

              5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

              SHA512

              baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

            • C:\Users\Admin\AppData\Local\Temp\2800317469.exe

              Filesize

              79KB

              MD5

              0c883b1d66afce606d9830f48d69d74b

              SHA1

              fe431fe73a4749722496f19b3b3ca0b629b50131

              SHA256

              d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

              SHA512

              c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

            • C:\Users\Admin\AppData\Local\Temp\2851726839.exe

              Filesize

              53KB

              MD5

              84897ca8c1aa06b33248956ac25ec20a

              SHA1

              544d5d5652069b3c5e7e29a1ca3eea46b227bbfe

              SHA256

              023ad16f761a35bd7934e392bcf2bbf702f525303b2964e97c3e50d2d5f3eda1

              SHA512

              c17d0e364cf29055dece3e10896f0bbd0ebdb8d2b1c15fe68ddcd9951dd2d1545362f45ad21f26302f3da2eb2ec81340a027cbd4c75cc28491151ecabae65e95

            • C:\Users\Admin\AppData\Local\Temp\3383528948.exe

              Filesize

              5.6MB

              MD5

              13b26b2c7048a92d6a843c1302618fad

              SHA1

              89c2dfc01ac12ef2704c7669844ec69f1700c1ca

              SHA256

              1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

              SHA512

              d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

            • C:\Users\Admin\AppData\Local\Temp\35876223.exe

              Filesize

              10KB

              MD5

              96509ab828867d81c1693b614b22f41d

              SHA1

              c5f82005dbda43cedd86708cc5fc3635a781a67e

              SHA256

              a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

              SHA512

              ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

            • C:\Users\Admin\AppData\Local\Temp\8491.exe

              Filesize

              10KB

              MD5

              08dafe3bb2654c06ead4bb33fb793df8

              SHA1

              d1d93023f1085eed136c6d225d998abf2d5a5bf0

              SHA256

              fc16c0bf09002c93723b8ab13595db5845a50a1b6a133237ac2d148b0bb41700

              SHA512

              9cf2bd749a9ee6e093979bc0d3aacfba03ad6469c98ff3ef35ce5d1635a052e4068ac50431626f6ba8649361802f7fb2ffffb2b325e2795c54b7014180559c99

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_53bunr2n.xgo.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\Montserrat-Regular.eot

              Filesize

              314KB

              MD5

              2dd0a1de870af34d48d43b7cad82b8d9

              SHA1

              440f4f1fdf17a5c8b426ac6bd4535b8fe5258c7e

              SHA256

              057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32

              SHA512

              83df193ab984037b940876bf6371020b4bb13af74e988abb8ad6a30d48ab6cd9dc5c08937e58abab93278cc85c9d79c373688b2c51c035fdeffed639c933e8ff

            • C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\preloader.html

              Filesize

              687B

              MD5

              a9c237c6645d55240cdda002fef26737

              SHA1

              8a7f5c4cf2fd1c924dd1ec754b1b4c5f65bdda80

              SHA256

              0271d97e4e245364c5c52e66d95baf24b3e00c1c8ea6e2b0da59291115cb6087

              SHA512

              480f28bffb5cb96eaf89f601fbf2de03fc5db04f579108b60de1e5be36ede324fc924f624bc29b42747e96f173a860a6fdbaf6da271b6bffb5b7906d11065555

            • C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\translations.json

              Filesize

              19KB

              MD5

              a1d597ef7be818c9fa9daa8f18ebf125

              SHA1

              8108290387bfb433c6867d6f29b28f68b6f803c6

              SHA256

              b451d4eb04fbf6ea5a92b2d6d1b911c66ef98b7a438fbc3de867c3e91ba86c7a

              SHA512

              4b7f09b47d182ea45f8ef50dc77e24a9c4e036f15728c11409651d4513a16e8db06f99a8132a363dc0e6870563f1d419c6e8f692ef6d08eaf340401cccc11123

            • memory/368-107-0x00007FF71E250000-0x00007FF71E7E7000-memory.dmp

              Filesize

              5.6MB

            • memory/1384-46-0x00000000005C0000-0x00000000005C6000-memory.dmp

              Filesize

              24KB

            • memory/2396-130-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp

              Filesize

              7.9MB

            • memory/2396-123-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp

              Filesize

              7.9MB

            • memory/2396-108-0x000001F944E50000-0x000001F944E70000-memory.dmp

              Filesize

              128KB

            • memory/2396-110-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp

              Filesize

              7.9MB

            • memory/2396-128-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp

              Filesize

              7.9MB

            • memory/2396-126-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp

              Filesize

              7.9MB

            • memory/2396-113-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp

              Filesize

              7.9MB

            • memory/2396-115-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp

              Filesize

              7.9MB

            • memory/2396-117-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp

              Filesize

              7.9MB

            • memory/2396-119-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp

              Filesize

              7.9MB

            • memory/2396-121-0x00007FF75B060000-0x00007FF75B84F000-memory.dmp

              Filesize

              7.9MB

            • memory/4084-89-0x00007FF6EF540000-0x00007FF6EFAD7000-memory.dmp

              Filesize

              5.6MB

            • memory/5024-112-0x00007FF738370000-0x00007FF738399000-memory.dmp

              Filesize

              164KB

            • memory/5024-109-0x00007FF738370000-0x00007FF738399000-memory.dmp

              Filesize

              164KB

            • memory/5056-72-0x00000264EDCF0000-0x00000264EDD12000-memory.dmp

              Filesize

              136KB