Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
General
-
Target
d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe
-
Size
307KB
-
MD5
7a94b174414736f01e16901655337098
-
SHA1
15af50e4231263d8959a61b4ed4bf5e3be5d3d09
-
SHA256
d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808
-
SHA512
e8f39205d4cfd20b0aa475b3a6f051738c09658e0ef526d1eb0b2716a1ed09402554dd693e10df9191fa8bbc481a0911b172c4be612d808db1e10789928d3184
-
SSDEEP
6144:QXQP2B++PxQZDFZHnSMagSqNGb2/g4OZInzepIao:4DB+kxehaJqqpazx
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\E: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\G: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\I: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\M: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\Q: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\R: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\H: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\J: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\L: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\O: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\P: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\W: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\K: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\N: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\T: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\V: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\Z: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\F: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\S: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\U: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened (read-only) \??\X: d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe -
Drops file in System32 directory 27 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\vds.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\wbengine.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.vir d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\perfhost.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\spectrum.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\vssvc.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\Agentservice.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\openssh\ssh-agent.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\sgrmbroker.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\tieringengineservice.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\Appvclient.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File created \??\c:\windows\SysWOW64\msiexec.vir d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\sensordataservice.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\policytool.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\pack200.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.vir d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4632 d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe"C:\Users\Admin\AppData\Local\Temp\d781c6cc95f4b995adc4c996a32fc6072d21e947f69c9d7ef1ac09650ac46808.exe"1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4632