Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/10/2022, 10:59

General

  • Target

    d946ef83772061704929d211f7e0750e7ffaaa1fbb1b0668c5cde234591ff8db.exe

  • Size

    5.8MB

  • MD5

    889bd1a9dcd60031a788d796322d2070

  • SHA1

    d00ff2bf3cf217be715b7639f99f5e8366ce82a6

  • SHA256

    d946ef83772061704929d211f7e0750e7ffaaa1fbb1b0668c5cde234591ff8db

  • SHA512

    ef6d6b19a8f19974739a0871a4128368913eb47529e84a790a1a27a93aa6876bf6a7c811fa9b0d8aeaf9f699b0656eb019f63b0eb67b86601772051c8b321356

  • SSDEEP

    49152:qnV9xajFe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKgiR:qnV9xtSjL+EnHOMz5ysZA5+bf6c

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Program crash 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d946ef83772061704929d211f7e0750e7ffaaa1fbb1b0668c5cde234591ff8db.exe
    "C:\Users\Admin\AppData\Local\Temp\d946ef83772061704929d211f7e0750e7ffaaa1fbb1b0668c5cde234591ff8db.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 544
      2⤵
      • Program crash
      PID:4820
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 548
      2⤵
      • Program crash
      PID:60
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 580
      2⤵
      • Program crash
      PID:4832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 640
      2⤵
      • Program crash
      PID:2440
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 748
      2⤵
      • Program crash
      PID:5104
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 984
      2⤵
      • Program crash
      PID:3384
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1432
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1328
      2⤵
      • Program crash
      PID:4020
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1392
      2⤵
      • Program crash
      PID:4840
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1312
      2⤵
      • Program crash
      PID:3928
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic path win32_VideoController get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic path win32_VideoController get name
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4344
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic cpu get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic cpu get name
        3⤵
          PID:1784
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 312
        2⤵
        • Program crash
        PID:216

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1432-179-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-184-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-183-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-182-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-181-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-180-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-172-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/1432-173-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-155-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-156-0x00000000031B0000-0x00000000036CF000-memory.dmp

      Filesize

      5.1MB

    • memory/3836-157-0x0000000000400000-0x00000000009DE000-memory.dmp

      Filesize

      5.9MB

    • memory/3836-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-118-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-132-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-131-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-130-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-129-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-127-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-128-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-124-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-126-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-121-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB

    • memory/3836-384-0x0000000000400000-0x00000000009DE000-memory.dmp

      Filesize

      5.9MB

    • memory/3836-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp

      Filesize

      1.6MB