Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 05:29
Static task
static1
Behavioral task
behavioral1
Sample
0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe
Resource
win7-20220812-en
General
-
Target
0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe
-
Size
151KB
-
MD5
24fb53bb124ac23482579b1b5521431d
-
SHA1
f167cccc73fc1247c2be0454e8028f69545afe56
-
SHA256
0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf
-
SHA512
9e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96
-
SSDEEP
3072:7p596Yn5D72slWD6m39g5Qb+LNoOslm3LVNquOVVlvwp1eh8lSwgsout:F596+RfWD64+LNoDg3x7Uwqh8lSwzoS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4168 msservice32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msservice32.exe msservice32.exe File created C:\Windows\SysWOW64\msservice32.exe msservice32.exe File created C:\Windows\SysWOW64\msservice32.exe 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe File opened for modification C:\Windows\SysWOW64\msservice32.exe 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4788 wrote to memory of 4168 4788 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe 82 PID 4788 wrote to memory of 4168 4788 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe 82 PID 4788 wrote to memory of 4168 4788 0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe 82 PID 4168 wrote to memory of 1776 4168 msservice32.exe 88 PID 4168 wrote to memory of 1776 4168 msservice32.exe 88 PID 4168 wrote to memory of 1776 4168 msservice32.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe"C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\msservice32.exeC:\Windows\system32\msservice32.exe 1168 "C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat C:\Windows\SysWOW64\msservice32.exe3⤵PID:1776
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136B
MD5bfcf9cc6d1c37953dfa43312e2c36140
SHA107a4c0f29b282c34be24c312c4b920e479f4cee0
SHA256bac7cce52aeba3a2e2ce2bb6aebf50ffa65530d0d51ca49a2abc7f4e43ce3ce5
SHA512fb661474557e7168d4050607863b57649fa12a26ab9bd06078ae3254d003d76cfed4eac3d0a78a56eaf0ecc5b231d52788b6c8688cb14b0c86a37efe90f5f53a
-
Filesize
140B
MD52af6b05b1444223fc1d434b68ca1d70c
SHA1b005e12e00f09b008e0350a1d00f7f41b04524f4
SHA256bfa018f60b77d878d2b4ca34d710f310875141ea8e0ca29b8ea6664cf918ccac
SHA5121bbef765ed6fd3584715d9be5c4f4a0464a5e0f221b2d174ac60302c5a1c28b7ed9b0d7db997fa8a99bd6332f650d1122674da40dc7d927858af5e35d15e35ba
-
Filesize
151KB
MD524fb53bb124ac23482579b1b5521431d
SHA1f167cccc73fc1247c2be0454e8028f69545afe56
SHA2560795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf
SHA5129e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96
-
Filesize
151KB
MD524fb53bb124ac23482579b1b5521431d
SHA1f167cccc73fc1247c2be0454e8028f69545afe56
SHA2560795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf
SHA5129e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96