Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7v200410
  • submitted
    27/04/2020, 03:04

General

  • Target

    F820.tmp.exe

  • Size

    813KB

  • MD5

    42e683f3f24484bd47f079b114002571

  • SHA1

    4a7840d449e1454561a34c49f7d91224ef892e2c

  • SHA256

    ce90d07b63358dc14f246849d5a04b41692c849cdd2de04c2dc8b0e161a45b3e

  • SHA512

    fff26cf5458487b88872f5150cf3ee10a2d6b6a94a16e05daf672fb7407c0e417d8477b0d8a5ab96f417669c16149bea98a8075ab7609379cce7006a5be69c8f

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 77 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Drops file in Drivers directory 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Makes http(s) request 19 IoCs

    Contacts server via http/https, possibly for C2 communication.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Loads dropped DLL 16 IoCs
  • Executes dropped EXE 5 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Adds Run entry to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Checks for installed software on the system 1 TTPs 28 IoCs
  • Disables Task Manager via registry modification

Processes

  • C:\Users\Admin\AppData\Local\Temp\F820.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\F820.tmp.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Adds Run entry to start application
    • Suspicious behavior: EnumeratesProcesses
    PID:2024
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\5def4699-2071-43af-b361-72c272756e78" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:1640
    • C:\Users\Admin\AppData\Local\Temp\F820.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\F820.tmp.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious use of WriteProcessMemory
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:996
      • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
        "C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        • Loads dropped DLL
        • Executes dropped EXE
        PID:1748
        • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe
          "C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin1.exe" --Admin
          4⤵
          • Suspicious use of WriteProcessMemory
          • Loads dropped DLL
          • Executes dropped EXE
          PID:1780
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: EnumeratesProcesses
            PID:1840
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\script.ps1""' -Verb RunAs}"
            5⤵
            • Suspicious use of WriteProcessMemory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: EnumeratesProcesses
            PID:1584
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\script.ps1
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious behavior: EnumeratesProcesses
              PID:1164
          • C:\Program Files\Windows Defender\mpcmdrun.exe
            "C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all
            5⤵
              PID:1696
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""
              5⤵
                PID:1724
          • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin2.exe
            "C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\updatewin2.exe"
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            PID:1820
          • C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\5.exe
            "C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\5.exe"
            3⤵
            • Loads dropped DLL
            • Executes dropped EXE
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Checks for installed software on the system
            PID:1568
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & erase C:\Users\Admin\AppData\Local\41a7afab-c66a-4648-b64f-99eccafcb66c\5.exe & exit
              4⤵
                PID:1580
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /im 5.exe /f
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Kills process with taskkill
                  PID:1460
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          1⤵
            PID:1388
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {969DBEDC-FA5C-43ED-ADFC-B54FB9707DB8} S-1-5-21-3765897441-2376744223-3151462503-1000:BKIWADLA\Admin:Interactive:[1]
            1⤵
              PID:520
              • C:\Users\Admin\AppData\Local\5def4699-2071-43af-b361-72c272756e78\F820.tmp.exe
                C:\Users\Admin\AppData\Local\5def4699-2071-43af-b361-72c272756e78\F820.tmp.exe --Task
                2⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:700
            • C:\Windows\explorer.exe
              "C:\Windows\explorer.exe"
              1⤵
                PID:1772
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\_readme.txt
                1⤵
                • Opens file in notepad (likely ransom note)
                PID:1656

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/700-928-0x00000000045B0000-0x00000000045C1000-memory.dmp

                Filesize

                68KB

              • memory/700-927-0x0000000002D30000-0x0000000002DC1000-memory.dmp

                Filesize

                580KB

              • memory/996-3-0x0000000000320000-0x00000000003B1000-memory.dmp

                Filesize

                580KB

              • memory/996-59-0x0000000005DB0000-0x0000000005DC1000-memory.dmp

                Filesize

                68KB

              • memory/996-57-0x00000000061C0000-0x00000000061D1000-memory.dmp

                Filesize

                68KB

              • memory/996-56-0x0000000005DB0000-0x0000000005DC1000-memory.dmp

                Filesize

                68KB

              • memory/996-4-0x0000000004770000-0x0000000004781000-memory.dmp

                Filesize

                68KB

              • memory/1568-32-0x0000000000B70000-0x0000000000B81000-memory.dmp

                Filesize

                68KB

              • memory/1568-31-0x000000000030A000-0x000000000030B000-memory.dmp

                Filesize

                4KB

              • memory/1748-12-0x0000000002000000-0x0000000002011000-memory.dmp

                Filesize

                68KB

              • memory/1748-13-0x00000000005D0000-0x00000000005D1000-memory.dmp

                Filesize

                4KB

              • memory/1780-20-0x0000000001FB0000-0x0000000001FC1000-memory.dmp

                Filesize

                68KB

              • memory/1780-23-0x0000000000512000-0x0000000000513000-memory.dmp

                Filesize

                4KB

              • memory/1820-25-0x000000000059F000-0x00000000005A0000-memory.dmp

                Filesize

                4KB

              • memory/1820-24-0x0000000001F30000-0x0000000001F41000-memory.dmp

                Filesize

                68KB

              • memory/2024-0-0x0000000000300000-0x0000000000391000-memory.dmp

                Filesize

                580KB

              • memory/2024-1-0x00000000045B0000-0x00000000045C1000-memory.dmp

                Filesize

                68KB