Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    93s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/10/2022, 10:31

General

  • Target

    f1d662128e72fad0967b8f5b36675729ea2e8133e8d86cc50b1683475675e2ec.exe

  • Size

    5.8MB

  • MD5

    ac35fd4cbfd05ce0747b0f0d280d162e

  • SHA1

    45b401f686aefbcfc3e2a2d38ad52a3a3d999111

  • SHA256

    f1d662128e72fad0967b8f5b36675729ea2e8133e8d86cc50b1683475675e2ec

  • SHA512

    ae904993769c69b65fa214b164f1f06ca984e9dcd6dad589d82f2f6db3d5233a6877fa94c3db8409f2a570c324c87c173ed66df456a39b3b252d3740ebb7539d

  • SSDEEP

    49152:qnV9xabFe6iRyhJ3jkqQVSfWVXqASv1x1dKO/5t7WGiocfGJDcjQcy20RHrzKgiR:qnV9xVSjL+EnHOMz5ysZA5+bf6c

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Program crash 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1d662128e72fad0967b8f5b36675729ea2e8133e8d86cc50b1683475675e2ec.exe
    "C:\Users\Admin\AppData\Local\Temp\f1d662128e72fad0967b8f5b36675729ea2e8133e8d86cc50b1683475675e2ec.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 544
      2⤵
      • Program crash
      PID:5092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 560
      2⤵
      • Program crash
      PID:4100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 524
      2⤵
      • Program crash
      PID:3628
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 604
      2⤵
      • Program crash
      PID:4512
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 776
      2⤵
      • Program crash
      PID:3508
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 872
      2⤵
      • Program crash
      PID:2000
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2664
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1320
      2⤵
      • Program crash
      PID:4212
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1336
      2⤵
      • Program crash
      PID:4396
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1256
      2⤵
      • Program crash
      PID:3936
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic path win32_VideoController get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4428
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic path win32_VideoController get name
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3156
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic cpu get name"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic cpu get name
        3⤵
          PID:696
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 312
        2⤵
        • Program crash
        PID:96

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1736-116-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-117-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-118-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-119-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-120-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-121-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-122-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-123-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-124-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-125-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-126-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-127-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-128-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-129-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-130-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-131-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-132-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-133-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-135-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-134-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-136-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-137-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-138-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-139-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-140-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-141-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-142-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-143-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-144-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-145-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-146-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-147-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-148-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-149-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-150-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-151-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-152-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-153-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-154-0x0000000003260000-0x000000000377F000-memory.dmp

      Filesize

      5.1MB

    • memory/1736-155-0x0000000000400000-0x00000000009DE000-memory.dmp

      Filesize

      5.9MB

    • memory/1736-156-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-157-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-158-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-159-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-160-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-161-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-162-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-163-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-164-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-165-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-166-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-167-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/1736-382-0x0000000000400000-0x00000000009DE000-memory.dmp

      Filesize

      5.9MB

    • memory/2664-169-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-170-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-171-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-172-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-173-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-174-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-175-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-176-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-177-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-178-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-179-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-180-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-181-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2664-182-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB