Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2022, 07:22
Behavioral task
behavioral1
Sample
8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe
Resource
win10v2004-20220812-en
General
-
Target
8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe
-
Size
632KB
-
MD5
d3a9112f8479de6d0bb80daa086ee39d
-
SHA1
c7044e763bddd442c7ff7504efe954ea4dbe6848
-
SHA256
8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c
-
SHA512
0a604cea4bc5e13c6ac8bbbc381b9a1827e47ddde2b6713574e89ffd627eb2ac16be4760264a09d4894450d32359e9f2d233cef59dd5e9add6f1cf802f44d2d2
-
SSDEEP
12288:QAEx4EoqHsQdmxl6zbr+F3KUf79EAN9IT6uOB2f/9E8k:LEx45zxI+bcTFY2dC
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4500 attrib.exe -
resource yara_rule behavioral2/memory/4936-135-0x00007FF690440000-0x00007FF690575000-memory.dmp upx behavioral2/memory/4936-152-0x00007FF690440000-0x00007FF690575000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\QQDisabled 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4936-135-0x00007FF690440000-0x00007FF690575000-memory.dmp autoit_exe behavioral2/memory/4936-152-0x00007FF690440000-0x00007FF690575000-memory.dmp autoit_exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\First Home Page = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.cbala.com/" 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\new reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\new\ = "{D969A300-E7FF-11d0-A93B-00A0C90F2719}" reg.exe Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\ FileSyncEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\New reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\Sharing reg.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4936 wrote to memory of 4204 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 82 PID 4936 wrote to memory of 4204 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 82 PID 4936 wrote to memory of 3584 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 84 PID 4936 wrote to memory of 3584 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 84 PID 3584 wrote to memory of 4500 3584 cmd.exe 86 PID 3584 wrote to memory of 4500 3584 cmd.exe 86 PID 4936 wrote to memory of 4988 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 87 PID 4936 wrote to memory of 4988 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 87 PID 4936 wrote to memory of 4908 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 89 PID 4936 wrote to memory of 4908 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 89 PID 4908 wrote to memory of 1376 4908 cmd.exe 91 PID 4908 wrote to memory of 1376 4908 cmd.exe 91 PID 4936 wrote to memory of 1140 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 92 PID 4936 wrote to memory of 1140 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 92 PID 1140 wrote to memory of 684 1140 cmd.exe 94 PID 1140 wrote to memory of 684 1140 cmd.exe 94 PID 4936 wrote to memory of 4568 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 95 PID 4936 wrote to memory of 4568 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 95 PID 4568 wrote to memory of 3672 4568 cmd.exe 97 PID 4568 wrote to memory of 3672 4568 cmd.exe 97 PID 4936 wrote to memory of 3680 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 98 PID 4936 wrote to memory of 3680 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 98 PID 3680 wrote to memory of 3380 3680 cmd.exe 100 PID 3680 wrote to memory of 3380 3680 cmd.exe 100 PID 4936 wrote to memory of 212 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 101 PID 4936 wrote to memory of 212 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 101 PID 212 wrote to memory of 1964 212 cmd.exe 103 PID 212 wrote to memory of 1964 212 cmd.exe 103 PID 4936 wrote to memory of 1328 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 104 PID 4936 wrote to memory of 1328 4936 8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe 104 PID 1328 wrote to memory of 1920 1328 cmd.exe 106 PID 1328 wrote to memory of 1920 1328 cmd.exe 106 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4500 attrib.exe 1376 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe"C:\Users\Admin\AppData\Local\Temp\8a93ed0f80b337ece9ffc9380fe6b69b6a1c7c25052a8f8eefecdc5a13e9966c.exe"1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd C:\Users2⤵PID:4204
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +r +h +s desktop.ini2⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\system32\attrib.exeattrib +r +h +s desktop.ini3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cd ..2⤵PID:4988
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib +r C:\Users2⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\system32\attrib.exeattrib +r C:\Users3⤵
- Views/modifies file attributes
PID:1376
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c regsvr32 /u /s igfxpph.dll2⤵
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\system32\regsvr32.exeregsvr32 /u /s igfxpph.dll3⤵PID:684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers /f2⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\system32\reg.exereg delete HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers /f3⤵
- Modifies registry class
PID:3672
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\new /ve /d {D969A300-E7FF-11d0-A93B-00A0C90F2719}2⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\Directory\Background\shellex\ContextMenuHandlers\new /ve /d {D969A300-E7FF-11d0-A93B-00A0C90F2719}3⤵
- Modifies registry class
PID:3380
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v HotKeysCmds /f2⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\system32\reg.exereg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v HotKeysCmds /f3⤵PID:1964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v IgfxTray /f2⤵
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\system32\reg.exereg delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v IgfxTray /f3⤵PID:1920
-
-