Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2022, 05:29

General

  • Target

    0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe

  • Size

    151KB

  • MD5

    24fb53bb124ac23482579b1b5521431d

  • SHA1

    f167cccc73fc1247c2be0454e8028f69545afe56

  • SHA256

    0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf

  • SHA512

    9e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96

  • SSDEEP

    3072:7p596Yn5D72slWD6m39g5Qb+LNoOslm3LVNquOVVlvwp1eh8lSwgsout:F596+RfWD64+LNoDg3x7Uwqh8lSwzoS

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe
    "C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\SysWOW64\msservice32.exe
      C:\Windows\system32\msservice32.exe 1168 "C:\Users\Admin\AppData\Local\Temp\0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4168
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat C:\Windows\SysWOW64\msservice32.exe
        3⤵
          PID:1776

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\del.bat

      Filesize

      136B

      MD5

      bfcf9cc6d1c37953dfa43312e2c36140

      SHA1

      07a4c0f29b282c34be24c312c4b920e479f4cee0

      SHA256

      bac7cce52aeba3a2e2ce2bb6aebf50ffa65530d0d51ca49a2abc7f4e43ce3ce5

      SHA512

      fb661474557e7168d4050607863b57649fa12a26ab9bd06078ae3254d003d76cfed4eac3d0a78a56eaf0ecc5b231d52788b6c8688cb14b0c86a37efe90f5f53a

    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ycivfgho.default-release\user.js

      Filesize

      140B

      MD5

      2af6b05b1444223fc1d434b68ca1d70c

      SHA1

      b005e12e00f09b008e0350a1d00f7f41b04524f4

      SHA256

      bfa018f60b77d878d2b4ca34d710f310875141ea8e0ca29b8ea6664cf918ccac

      SHA512

      1bbef765ed6fd3584715d9be5c4f4a0464a5e0f221b2d174ac60302c5a1c28b7ed9b0d7db997fa8a99bd6332f650d1122674da40dc7d927858af5e35d15e35ba

    • C:\Windows\SysWOW64\msservice32.exe

      Filesize

      151KB

      MD5

      24fb53bb124ac23482579b1b5521431d

      SHA1

      f167cccc73fc1247c2be0454e8028f69545afe56

      SHA256

      0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf

      SHA512

      9e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96

    • C:\Windows\SysWOW64\msservice32.exe

      Filesize

      151KB

      MD5

      24fb53bb124ac23482579b1b5521431d

      SHA1

      f167cccc73fc1247c2be0454e8028f69545afe56

      SHA256

      0795512a7d68e8044431a3d04b632f057b1e8cdf26eab07d593b6c76705c31bf

      SHA512

      9e2124d97d4285781f2cb32240429023a19bb5eae036cd3c65f87f4a34def9af35d7d0a026b7f139d0c52377b404bdc6c50d38611643c37ef6fba8d24b835b96

    • memory/4168-137-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB

    • memory/4168-140-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB

    • memory/4788-132-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB

    • memory/4788-136-0x0000000000400000-0x00000000004B1000-memory.dmp

      Filesize

      708KB