Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    33s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 05:29

General

  • Target

    0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe

  • Size

    151KB

  • MD5

    24fb53bb124ac23482579b1b5521431d

  • SHA1

    f167cccc73fc1247c2be0454e8028f69545afe56

  • SHA256

    0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf

  • SHA512

    9e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96

  • SSDEEP

    3072:7p596Yn5D72slWD6m39g5Qb+LNoOslm3LVNquOVVlvwp1eh8lSwgsout:F596+RfWD64+LNoDg3x7Uwqh8lSwzoS

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe
    "C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:892
    • C:\Windows\SysWOW64\msservice32.exe
      C:\Windows\system32\msservice32.exe 544 "C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe"
      2⤵
      • Executes dropped EXE
      • Deletes itself
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1520
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat C:\Windows\SysWOW64\msservice32.exe
        3⤵
          PID:2032

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\del.bat

      Filesize

      136B

      MD5

      bfcf9cc6d1c37953dfa43312e2c36140

      SHA1

      07a4c0f29b282c34be24c312c4b920e479f4cee0

      SHA256

      bac7cce52aeba3a2e2ce2bb6aebf50ffa65530d0d51ca49a2abc7f4e43ce3ce5

      SHA512

      fb661474557e7168d4050607863b57649fa12a26ab9bd06078ae3254d003d76cfed4eac3d0a78a56eaf0ecc5b231d52788b6c8688cb14b0c86a37efe90f5f53a

    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iwv3qbnj.default-release\user.js

      Filesize

      140B

      MD5

      66592a3bacbb2eff53b68c9a855e1415

      SHA1

      2d8af06f3bd14f1c4385844ed775ecedc359f956

      SHA256

      2efd510d0038b58198efda885cad58ec2a1dc9345b354572f54ad41ce521b277

      SHA512

      ebb22c7d3e1e30dfc26b55fda6abfa9df0973751ac43e396244e6697142f74f5a1117d7e7f24cb4d4c02ce369c4c21091876a0cb9ace86a2b6590b023b89bd4c

    • C:\Windows\SysWOW64\msservice32.exe

      Filesize

      151KB

      MD5

      24fb53bb124ac23482579b1b5521431d

      SHA1

      f167cccc73fc1247c2be0454e8028f69545afe56

      SHA256

      0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf

      SHA512

      9e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96

    • C:\Windows\SysWOW64\msservice32.exe

      Filesize

      151KB

      MD5

      24fb53bb124ac23482579b1b5521431d

      SHA1

      f167cccc73fc1247c2be0454e8028f69545afe56

      SHA256

      0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf

      SHA512

      9e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96

    • \Windows\SysWOW64\msservice32.exe

      Filesize

      151KB

      MD5

      24fb53bb124ac23482579b1b5521431d

      SHA1

      f167cccc73fc1247c2be0454e8028f69545afe56

      SHA256

      0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf

      SHA512

      9e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96

    • \Windows\SysWOW64\msservice32.exe

      Filesize

      151KB

      MD5

      24fb53bb124ac23482579b1b5521431d

      SHA1

      f167cccc73fc1247c2be0454e8028f69545afe56

      SHA256

      0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf

      SHA512

      9e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96

    • memory/892-61-0x0000000002640000-0x00000000026F1000-memory.dmp

      Filesize

      708KB

    • memory/892-63-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB

    • memory/892-60-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB

    • memory/892-54-0x0000000075141000-0x0000000075143000-memory.dmp

      Filesize

      8KB

    • memory/1520-62-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB

    • memory/1520-67-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB