Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 04:38
Behavioral task
behavioral1
Sample
cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe
Resource
win10v2004-20220812-en
General
-
Target
cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe
-
Size
1021KB
-
MD5
3e4ca6a3cca067661b7b61a9c2ec845a
-
SHA1
e80e816698ce5393c2456ca84a2cc6d0477cba62
-
SHA256
cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403
-
SHA512
ce731c70e79d6171ae01c4538e735f0cd1a3a6126dad77bb70514f227ef9f6ec6517a98fc8728d0ce72e77df74312764f56c6d4313eee103f3ad0f695a1c59df
-
SSDEEP
24576:VI2Q4saclFkm9uUOcl9mpx/m/eDHmI0/zdC5vopcK21jo:Gb4ClFkmYUw3/RDfqC5vZU
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1672-65-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1520-71-0x0000000000400000-0x0000000000645000-memory.dmp upx behavioral1/memory/1520-73-0x0000000000400000-0x0000000000645000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe" cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1672 set thread context of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1580 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 27 PID 1672 wrote to memory of 1580 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 27 PID 1672 wrote to memory of 1580 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 27 PID 1672 wrote to memory of 1580 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 27 PID 1672 wrote to memory of 696 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 28 PID 1672 wrote to memory of 696 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 28 PID 1672 wrote to memory of 696 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 28 PID 1672 wrote to memory of 696 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 28 PID 1672 wrote to memory of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29 PID 1672 wrote to memory of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29 PID 1672 wrote to memory of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29 PID 1672 wrote to memory of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29 PID 1672 wrote to memory of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29 PID 1672 wrote to memory of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29 PID 1672 wrote to memory of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29 PID 1672 wrote to memory of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29 PID 1672 wrote to memory of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29 PID 1672 wrote to memory of 1520 1672 cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe"C:\Users\Admin\AppData\Local\Temp\cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exeC:\Users\Admin\AppData\Local\Temp\cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe2⤵PID:1580
-
-
C:\Users\Admin\AppData\Local\Temp\cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exeC:\Users\Admin\AppData\Local\Temp\cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe2⤵PID:696
-
-
C:\Users\Admin\AppData\Local\Temp\cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exeC:\Users\Admin\AppData\Local\Temp\cc045b5fb2303b15282f49da151fc7bc7835b058e2b42e804c4468cf58f57403.exe2⤵
- Adds Run key to start application
PID:1520
-