Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    14/04/2022, 07:32

General

  • Target

    0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f.exe

  • Size

    367KB

  • MD5

    01f9c5c62b69dfbc7a527f5c9d7cd631

  • SHA1

    2bac0647e62a496b018ba9debfcb3281b6a89044

  • SHA256

    0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f

  • SHA512

    cf0707d0dee549eb556dada33b13d3d8a5786e18525111505c9015422fe598d019237cdd86e3328f14d273cd735767e35eb2c09c26863291e90bb95f1bae0486

Malware Config

Signatures

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f.exe
    "C:\Users\Admin\AppData\Local\Temp\0040225cba2bdf8ada83f22d426316c0c7e5c3c79b55710f993afe2c3202003f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 1340
      2⤵
      • Program crash
      PID:260
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3392 -ip 3392
    1⤵
      PID:3512

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3392-124-0x00000000007B2000-0x00000000007DC000-memory.dmp

      Filesize

      168KB

    • memory/3392-125-0x00000000007B2000-0x00000000007DC000-memory.dmp

      Filesize

      168KB

    • memory/3392-126-0x0000000000710000-0x0000000000747000-memory.dmp

      Filesize

      220KB

    • memory/3392-127-0x0000000000400000-0x0000000000484000-memory.dmp

      Filesize

      528KB

    • memory/3392-128-0x0000000004B90000-0x0000000005134000-memory.dmp

      Filesize

      5.6MB

    • memory/3392-129-0x0000000005170000-0x0000000005788000-memory.dmp

      Filesize

      6.1MB

    • memory/3392-130-0x0000000005820000-0x0000000005832000-memory.dmp

      Filesize

      72KB

    • memory/3392-131-0x0000000005840000-0x000000000594A000-memory.dmp

      Filesize

      1.0MB

    • memory/3392-132-0x0000000005990000-0x00000000059CC000-memory.dmp

      Filesize

      240KB

    • memory/3392-133-0x0000000004B84000-0x0000000004B86000-memory.dmp

      Filesize

      8KB

    • memory/3392-134-0x0000000005C70000-0x0000000005D02000-memory.dmp

      Filesize

      584KB

    • memory/3392-135-0x0000000005D10000-0x0000000005D86000-memory.dmp

      Filesize

      472KB

    • memory/3392-136-0x0000000005F40000-0x0000000005F5E000-memory.dmp

      Filesize

      120KB

    • memory/3392-137-0x0000000005F90000-0x0000000005FF6000-memory.dmp

      Filesize

      408KB

    • memory/3392-138-0x00000000081C0000-0x0000000008382000-memory.dmp

      Filesize

      1.8MB

    • memory/3392-139-0x0000000008650000-0x0000000008B7C000-memory.dmp

      Filesize

      5.2MB