Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
49s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09/07/2020, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe
Resource
win7
Behavioral task
behavioral2
Sample
2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe
Resource
win10v200430
General
-
Target
2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe
-
Size
3.6MB
-
MD5
6a594f559bff2fa3ff115c0dc83336e5
-
SHA1
d3c4f8223888e5c09397ed08ee701231ebdb1355
-
SHA256
2370a6234d8a97737a93039e6129746750191dec4b6f7015a61db9a3aaa131c8
-
SHA512
4c9093710174b0dcfd766fae20fb7ccf29aae6860ba34997cba07dab55b191253c3b762ab4f6a14c76be8c3a37f00bc995add3da0e087cd15714c76a16403d77
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 98 IoCs
pid Process 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 3792 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe -
Loads dropped DLL 2 IoCs
pid Process 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe Token: SeCreatePagefilePrivilege 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 992 wrote to memory of 3792 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 69 PID 992 wrote to memory of 3792 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 69 PID 992 wrote to memory of 3792 992 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe 69 -
js 2 IoCs
resource yara_rule behavioral2/memory/992-2-0x0000000003CF0000-0x00000000042B2000-memory.dmp js behavioral2/memory/3792-599-0x0000000003DA0000-0x0000000004362000-memory.dmp js -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe"C:\Users\Admin\AppData\Local\Temp\2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- Enumerates system info in registry
- Checks processor information in registry
PID:992 -
C:\Users\Admin\AppData\Local\Temp\2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe"C:\Users\Admin\AppData\Local\Temp\2370A6234D8A97737A93039E6129746750191DEC4B6F7015A61DB9A3AAA131C8.exe" /_ShowProgress /mnl2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3792
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4020