Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 02:54
Behavioral task
behavioral1
Sample
AXmudvi_MxQYK2Swucq9CluH.exe
Resource
win7-20240903-en
General
-
Target
AXmudvi_MxQYK2Swucq9CluH.exe
-
Size
1.4MB
-
MD5
ecad37c9dbd960cae35da8c5ba2cba3b
-
SHA1
5aff572af1769d19692a9e25fdd5f180a4743fb7
-
SHA256
c136ce5780472330b6210c23508ffdacf4a6bd87931267a7e37b5fb940963227
-
SHA512
f2645dc3a0ca7f87df8258e65b25583686107735ff451e9ca2e44870391a26f1c985af2a16c895daa77e02a77d444e4f61c4f96d5fc6323e734609bb5715d033
-
SSDEEP
24576:KEpfLmZkUtN/Wy+jtYkQkbF7vZjHYdG/9QDkMhJgXgalJAiQ/X:7pylrKY2m4+7/gXgalJZwX
Malware Config
Signatures
-
Socelars family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 iplogger.org 5 iplogger.org -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AXmudvi_MxQYK2Swucq9CluH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 2616 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeAssignPrimaryTokenPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeLockMemoryPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeIncreaseQuotaPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeMachineAccountPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeTcbPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeSecurityPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeTakeOwnershipPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeLoadDriverPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeSystemProfilePrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeSystemtimePrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeProfSingleProcessPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeIncBasePriorityPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeCreatePagefilePrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeCreatePermanentPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeBackupPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeRestorePrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeShutdownPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeDebugPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeAuditPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeSystemEnvironmentPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeChangeNotifyPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeRemoteShutdownPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeUndockPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeSyncAgentPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeEnableDelegationPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeManageVolumePrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeImpersonatePrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeCreateGlobalPrivilege 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: 31 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: 32 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: 33 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: 34 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: 35 1868 AXmudvi_MxQYK2Swucq9CluH.exe Token: SeDebugPrivilege 2616 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1868 wrote to memory of 760 1868 AXmudvi_MxQYK2Swucq9CluH.exe 28 PID 1868 wrote to memory of 760 1868 AXmudvi_MxQYK2Swucq9CluH.exe 28 PID 1868 wrote to memory of 760 1868 AXmudvi_MxQYK2Swucq9CluH.exe 28 PID 1868 wrote to memory of 760 1868 AXmudvi_MxQYK2Swucq9CluH.exe 28 PID 760 wrote to memory of 2616 760 cmd.exe 30 PID 760 wrote to memory of 2616 760 cmd.exe 30 PID 760 wrote to memory of 2616 760 cmd.exe 30 PID 760 wrote to memory of 2616 760 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\AXmudvi_MxQYK2Swucq9CluH.exe"C:\Users\Admin\AppData\Local\Temp\AXmudvi_MxQYK2Swucq9CluH.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-