Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    13/04/2022, 23:22

General

  • Target

    8a7848405bcbf2acff3e0c5774e336a15a5f3625bffeb2c2408bba3f152cf91b.exe

  • Size

    367KB

  • MD5

    9fc0f49d2c051712f973ada16a8852fc

  • SHA1

    df74a2a314042138a992192e89f35dcde91be54f

  • SHA256

    8a7848405bcbf2acff3e0c5774e336a15a5f3625bffeb2c2408bba3f152cf91b

  • SHA512

    8bdf52f51cded026733d8135b231ae7e1e7b71044345cec759b5de2414f2e53a32c99e64cd279411f06c5517d756e848dd292e05bece9bef71bcb99ada689205

Malware Config

Signatures

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a7848405bcbf2acff3e0c5774e336a15a5f3625bffeb2c2408bba3f152cf91b.exe
    "C:\Users\Admin\AppData\Local\Temp\8a7848405bcbf2acff3e0c5774e336a15a5f3625bffeb2c2408bba3f152cf91b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2436
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 1536
      2⤵
      • Program crash
      PID:4644
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2436 -ip 2436
    1⤵
      PID:4836

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2436-134-0x0000000000622000-0x000000000064C000-memory.dmp

      Filesize

      168KB

    • memory/2436-135-0x0000000000622000-0x000000000064C000-memory.dmp

      Filesize

      168KB

    • memory/2436-136-0x0000000000710000-0x0000000000747000-memory.dmp

      Filesize

      220KB

    • memory/2436-137-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB

    • memory/2436-138-0x0000000004D70000-0x0000000005314000-memory.dmp

      Filesize

      5.6MB

    • memory/2436-139-0x0000000005320000-0x0000000005938000-memory.dmp

      Filesize

      6.1MB

    • memory/2436-140-0x0000000004C40000-0x0000000004C52000-memory.dmp

      Filesize

      72KB

    • memory/2436-141-0x0000000005940000-0x0000000005A4A000-memory.dmp

      Filesize

      1.0MB

    • memory/2436-142-0x0000000004D64000-0x0000000004D66000-memory.dmp

      Filesize

      8KB

    • memory/2436-143-0x0000000004CA0000-0x0000000004CDC000-memory.dmp

      Filesize

      240KB

    • memory/2436-144-0x0000000005C70000-0x0000000005D02000-memory.dmp

      Filesize

      584KB

    • memory/2436-145-0x0000000005D10000-0x0000000005D76000-memory.dmp

      Filesize

      408KB

    • memory/2436-146-0x0000000006430000-0x00000000064A6000-memory.dmp

      Filesize

      472KB

    • memory/2436-147-0x0000000006500000-0x000000000651E000-memory.dmp

      Filesize

      120KB

    • memory/2436-148-0x0000000008690000-0x0000000008852000-memory.dmp

      Filesize

      1.8MB

    • memory/2436-149-0x0000000008860000-0x0000000008D8C000-memory.dmp

      Filesize

      5.2MB