Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21/12/2024, 09:46
Behavioral task
behavioral1
Sample
51ff79b406cb223dd49dd4c947ec97b0.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
51ff79b406cb223dd49dd4c947ec97b0.exe
Resource
win10v2004-20241007-en
General
-
Target
51ff79b406cb223dd49dd4c947ec97b0.exe
-
Size
429KB
-
MD5
51ff79b406cb223dd49dd4c947ec97b0
-
SHA1
b9b0253480a1b6cbdd673383320fecae5efb3dce
-
SHA256
2e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e
-
SHA512
c2b8d15b0dc1b0846f39ce007be2deb41d5b6ae76af90d618f29da8691ed987c42f3c270f0ea7f4d10cbd2d3877118f4133803c9c965b6ff236ff8cfafd9367c
-
SSDEEP
12288:v4RG6lx/9Njr18QlSfJy4FjMSkJCzDLGDWD:O9NtSTZMzmmD4
Malware Config
Signatures
-
Amadey family
-
Blocklisted process makes network request 2 IoCs
flow pid Process 7 2812 rundll32.exe 10 1864 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1040 Gxtuum.exe -
Loads dropped DLL 13 IoCs
pid Process 2220 51ff79b406cb223dd49dd4c947ec97b0.exe 2812 rundll32.exe 2812 rundll32.exe 2812 rundll32.exe 2812 rundll32.exe 2216 rundll32.exe 2216 rundll32.exe 2216 rundll32.exe 2216 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Gxtuum.job 51ff79b406cb223dd49dd4c947ec97b0.exe -
pid Process 564 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51ff79b406cb223dd49dd4c947ec97b0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gxtuum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2952 netsh.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 564 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 564 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 51ff79b406cb223dd49dd4c947ec97b0.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2220 wrote to memory of 1040 2220 51ff79b406cb223dd49dd4c947ec97b0.exe 29 PID 2220 wrote to memory of 1040 2220 51ff79b406cb223dd49dd4c947ec97b0.exe 29 PID 2220 wrote to memory of 1040 2220 51ff79b406cb223dd49dd4c947ec97b0.exe 29 PID 2220 wrote to memory of 1040 2220 51ff79b406cb223dd49dd4c947ec97b0.exe 29 PID 1040 wrote to memory of 2812 1040 Gxtuum.exe 31 PID 1040 wrote to memory of 2812 1040 Gxtuum.exe 31 PID 1040 wrote to memory of 2812 1040 Gxtuum.exe 31 PID 1040 wrote to memory of 2812 1040 Gxtuum.exe 31 PID 1040 wrote to memory of 2812 1040 Gxtuum.exe 31 PID 1040 wrote to memory of 2812 1040 Gxtuum.exe 31 PID 1040 wrote to memory of 2812 1040 Gxtuum.exe 31 PID 1040 wrote to memory of 2216 1040 Gxtuum.exe 33 PID 1040 wrote to memory of 2216 1040 Gxtuum.exe 33 PID 1040 wrote to memory of 2216 1040 Gxtuum.exe 33 PID 1040 wrote to memory of 2216 1040 Gxtuum.exe 33 PID 1040 wrote to memory of 2216 1040 Gxtuum.exe 33 PID 1040 wrote to memory of 2216 1040 Gxtuum.exe 33 PID 1040 wrote to memory of 2216 1040 Gxtuum.exe 33 PID 2216 wrote to memory of 1864 2216 rundll32.exe 34 PID 2216 wrote to memory of 1864 2216 rundll32.exe 34 PID 2216 wrote to memory of 1864 2216 rundll32.exe 34 PID 2216 wrote to memory of 1864 2216 rundll32.exe 34 PID 1864 wrote to memory of 2952 1864 rundll32.exe 35 PID 1864 wrote to memory of 2952 1864 rundll32.exe 35 PID 1864 wrote to memory of 2952 1864 rundll32.exe 35 PID 1864 wrote to memory of 564 1864 rundll32.exe 37 PID 1864 wrote to memory of 564 1864 rundll32.exe 37 PID 1864 wrote to memory of 564 1864 rundll32.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\51ff79b406cb223dd49dd4c947ec97b0.exe"C:\Users\Admin\AppData\Local\Temp\51ff79b406cb223dd49dd4c947ec97b0.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\e458d263c0\Gxtuum.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2812
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\cred64.dll, Main3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\48cb35e3030a2b\cred64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\692679935401_Desktop.zip' -CompressionLevel Optimal5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD56da95e327211f460d11793e0a5f9e4b2
SHA1fe8fe27cdbc733853c94b8fde306ba1dc424cc7d
SHA2564e9e75f5cfdde02c870040561d30db1019f0bf1c917d62f00cd8504ccfe6703f
SHA51239776923e110d7ab9cec6cea4371c32fb8b550c81739626aea841dcbb215fdc945e2e34aec3a3d1687e37284484fa292b1e24df98fcd5d7b1fa4c6402e41b5e7
-
Filesize
429KB
MD551ff79b406cb223dd49dd4c947ec97b0
SHA1b9b0253480a1b6cbdd673383320fecae5efb3dce
SHA2562e3a5dfa44d59681a60d78b8b08a1af3878d8e270c02d7e31a0876a85eb42a7e
SHA512c2b8d15b0dc1b0846f39ce007be2deb41d5b6ae76af90d618f29da8691ed987c42f3c270f0ea7f4d10cbd2d3877118f4133803c9c965b6ff236ff8cfafd9367c
-
Filesize
124KB
MD57fe5b933ed9391ea24647479c80e904e
SHA1963721e46b8056e2e883c598e95d7daa7bdf8d9b
SHA2562e12355cb9b11c923dc06f195399d678bc46680e982856d9405f64e7563fe8b3
SHA51282d92d0c5155fff5ce97099cb9e78422ff328e0c516fbab7634e624215366c2191ec6ff6fe8d939268275c6770accb208af7ac69c3cc13c9188a49ef41339bb0
-
Filesize
1.2MB
MD5d862c12a4467ebae581a8c0cc3ea2211
SHA19e797375b9b4422b2314d3e372628643ccf1c5db
SHA25647f8a270b27c18bab9013f4a8f0ee6e877e4050bd4018d682eb502bcfd5bff6d
SHA512cf6545df4a244bb7dc699a565759f97c759ba19bcc9ad9ad91a20cd07aee19cbe10eb82dd21416b717581b34dc4f24ba6d43a00e7d8018b8be133dbbc9e8113c