Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 23:35
Static task
static1
Behavioral task
behavioral1
Sample
f1a70606f8e5dc80a76c6d15b31bd3e1b1c50c9ff3b0a829cbd0675aa9ff8868.exe
Resource
win7-20221111-en
General
-
Target
f1a70606f8e5dc80a76c6d15b31bd3e1b1c50c9ff3b0a829cbd0675aa9ff8868.exe
-
Size
2.0MB
-
MD5
d2767e28359032c0f18a9835bdd910a8
-
SHA1
8ef6dfc5c7bd68f285b2d1cccb90575113755455
-
SHA256
f1a70606f8e5dc80a76c6d15b31bd3e1b1c50c9ff3b0a829cbd0675aa9ff8868
-
SHA512
cef6b8ff8527b0ca65565c8d79ca3dff42a2b2b9e2aa78703016ea3824048f4fc432b185ddf1d29d4864c4ce87089a424b8b3d3dd90bdb04d4f5531ce54d1d2d
-
SSDEEP
49152:h1OskCn3b0sdq9tVkWMq0vdovSHhXXruG:h1OAnL0sitVkWX0vVlL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2364 xZFN5PjoPdEGy0q.exe -
Loads dropped DLL 3 IoCs
pid Process 2364 xZFN5PjoPdEGy0q.exe 3004 regsvr32.exe 2864 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkcaafccohincendilfnmbmmbflilfkl\2.0\manifest.json xZFN5PjoPdEGy0q.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkcaafccohincendilfnmbmmbflilfkl\2.0\manifest.json xZFN5PjoPdEGy0q.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkcaafccohincendilfnmbmmbflilfkl\2.0\manifest.json xZFN5PjoPdEGy0q.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkcaafccohincendilfnmbmmbflilfkl\2.0\manifest.json xZFN5PjoPdEGy0q.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkcaafccohincendilfnmbmmbflilfkl\2.0\manifest.json xZFN5PjoPdEGy0q.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} xZFN5PjoPdEGy0q.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects xZFN5PjoPdEGy0q.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} xZFN5PjoPdEGy0q.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ xZFN5PjoPdEGy0q.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\GoSAvE\bxERWUUUYj2Vgm.tlb xZFN5PjoPdEGy0q.exe File created C:\Program Files (x86)\GoSAvE\bxERWUUUYj2Vgm.dat xZFN5PjoPdEGy0q.exe File opened for modification C:\Program Files (x86)\GoSAvE\bxERWUUUYj2Vgm.dat xZFN5PjoPdEGy0q.exe File created C:\Program Files (x86)\GoSAvE\bxERWUUUYj2Vgm.x64.dll xZFN5PjoPdEGy0q.exe File opened for modification C:\Program Files (x86)\GoSAvE\bxERWUUUYj2Vgm.x64.dll xZFN5PjoPdEGy0q.exe File created C:\Program Files (x86)\GoSAvE\bxERWUUUYj2Vgm.dll xZFN5PjoPdEGy0q.exe File opened for modification C:\Program Files (x86)\GoSAvE\bxERWUUUYj2Vgm.dll xZFN5PjoPdEGy0q.exe File created C:\Program Files (x86)\GoSAvE\bxERWUUUYj2Vgm.tlb xZFN5PjoPdEGy0q.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2364 2136 f1a70606f8e5dc80a76c6d15b31bd3e1b1c50c9ff3b0a829cbd0675aa9ff8868.exe 85 PID 2136 wrote to memory of 2364 2136 f1a70606f8e5dc80a76c6d15b31bd3e1b1c50c9ff3b0a829cbd0675aa9ff8868.exe 85 PID 2136 wrote to memory of 2364 2136 f1a70606f8e5dc80a76c6d15b31bd3e1b1c50c9ff3b0a829cbd0675aa9ff8868.exe 85 PID 2364 wrote to memory of 3004 2364 xZFN5PjoPdEGy0q.exe 86 PID 2364 wrote to memory of 3004 2364 xZFN5PjoPdEGy0q.exe 86 PID 2364 wrote to memory of 3004 2364 xZFN5PjoPdEGy0q.exe 86 PID 3004 wrote to memory of 2864 3004 regsvr32.exe 87 PID 3004 wrote to memory of 2864 3004 regsvr32.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1a70606f8e5dc80a76c6d15b31bd3e1b1c50c9ff3b0a829cbd0675aa9ff8868.exe"C:\Users\Admin\AppData\Local\Temp\f1a70606f8e5dc80a76c6d15b31bd3e1b1c50c9ff3b0a829cbd0675aa9ff8868.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\7zSA8E7.tmp\xZFN5PjoPdEGy0q.exe.\xZFN5PjoPdEGy0q.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSAvE\bxERWUUUYj2Vgm.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSAvE\bxERWUUUYj2Vgm.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:2864
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD54d899c607ab606f9fa0b85a38a4a25a0
SHA195ccd3630db8473092104f6e7784695479171467
SHA25668fe898331aa483f872400a03b8f664ee2d0817a9f42ce212fec7a80cfdddf90
SHA5125dd498bf45034e40192da53e42891ee6e7b1a6ca4edfe4a6ba6f0fb00e8c49885899143d7f387b1017847dd5dfc5d167a6b8a46fda76a00410e001a22a97ecf8
-
Filesize
613KB
MD5c547ac330285a0ea3ab373fbf632e095
SHA11c7a20d9bf6104c3c3343f0c4061107441348787
SHA2568ad6a8d9db588353ff1cb777ac8b7f62b6a8976d2ed396e8816051ffc69c8db0
SHA512b695eddc8d688d61b55a87d6153084836bb8c699a0e9b2834c77fed923e1ffa6da8871df569310668eff2161eb219eec8193bfcf812d9932f1ae064953d1b9a2
-
Filesize
693KB
MD52be2d271d3ab4d63bb6642af32722936
SHA1c3eb0dd1d280018ab15a44c65c6b1b23dcef1552
SHA256ad58666ae0f8f9d875e47a885ac5d89fca0ac1ae65c063fd8e01f1f88acca0e9
SHA51208106cfa29b4a5f0616451e402c7cc246d7a4c3f333e18da7c73b0c7d94e06845f3c34cea570ab2afd7b3054da0a7c665b2c14a7a02d99a744cefd9c017cac9f
-
Filesize
693KB
MD52be2d271d3ab4d63bb6642af32722936
SHA1c3eb0dd1d280018ab15a44c65c6b1b23dcef1552
SHA256ad58666ae0f8f9d875e47a885ac5d89fca0ac1ae65c063fd8e01f1f88acca0e9
SHA51208106cfa29b4a5f0616451e402c7cc246d7a4c3f333e18da7c73b0c7d94e06845f3c34cea570ab2afd7b3054da0a7c665b2c14a7a02d99a744cefd9c017cac9f
-
Filesize
693KB
MD52be2d271d3ab4d63bb6642af32722936
SHA1c3eb0dd1d280018ab15a44c65c6b1b23dcef1552
SHA256ad58666ae0f8f9d875e47a885ac5d89fca0ac1ae65c063fd8e01f1f88acca0e9
SHA51208106cfa29b4a5f0616451e402c7cc246d7a4c3f333e18da7c73b0c7d94e06845f3c34cea570ab2afd7b3054da0a7c665b2c14a7a02d99a744cefd9c017cac9f
-
C:\Users\Admin\AppData\Local\Temp\7zSA8E7.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSA8E7.tmp\[email protected]\chrome.manifest
Filesize35B
MD5677941846d81b215eeebb044e522bc20
SHA19b09d9e31a53d7fe00519579809237f94a7df029
SHA2563a7b16997aa780f1ad0a6600d5e2f789dc8369bb1d163f7caf8840eec81218c0
SHA5125c8cdd7a97e173d153c7ba35d9270df917abf4431a369571339676f811519ca5687ab861fd63627eaa51ddbcda4701b80e353990b567310dc2b9d1a1a3af4fb8
-
C:\Users\Admin\AppData\Local\Temp\7zSA8E7.tmp\[email protected]\content\bg.js
Filesize7KB
MD562ee1e4965d2f17404e37016a541c3f9
SHA152d288a7490cbe85b65f366f93bd76e730693304
SHA256f1dc53b8a51aec1fbbcd4380b17d91a6722c5abc5da7fcc36fda1d99e1831a2a
SHA512244c58ec2a8f6fca27a97575f4a7c6fa0f7852e186ce0b29b4f00f3352c42689c2962dba4363fb35014524875cfdf34201e8d31e199cabc9c21277fa5945dbe1
-
C:\Users\Admin\AppData\Local\Temp\7zSA8E7.tmp\[email protected]\install.rdf
Filesize591B
MD5012f9f1996986b7dd2d70f1bd7d476c9
SHA158cab76cacadf4a43c1ab3009648b39edf965750
SHA256b58976b9a5139c52ce4ce702f2806836750658b506eb8a7d48a7dff009b12496
SHA512635db5740d69691c66151b6542a77c3c6840f4c6cd59b27e72d60aab42fdc6c9e254b2dece6da535281717cc5cc45bfdb4249832be44bd7b96cd4d025e722488
-
Filesize
613KB
MD5c547ac330285a0ea3ab373fbf632e095
SHA11c7a20d9bf6104c3c3343f0c4061107441348787
SHA2568ad6a8d9db588353ff1cb777ac8b7f62b6a8976d2ed396e8816051ffc69c8db0
SHA512b695eddc8d688d61b55a87d6153084836bb8c699a0e9b2834c77fed923e1ffa6da8871df569310668eff2161eb219eec8193bfcf812d9932f1ae064953d1b9a2
-
Filesize
3KB
MD5b09701113a6fa6b7ce61cef1f5b3dc70
SHA1752190cbbd25d899b48f6fc2caa9cedd3baff7df
SHA256a8a8b11da1822ce3d93baa6d3711969425dd4ccbe05bf348899320659b07e9d1
SHA5129436a606e8ced02094374e5d603bc4bfb63a079259fa10c1fd82b9a30c40fa64c54b4bc3f7d5c0634dc4584c18e3accadd5df536e37367a7b3ea9f6597eb547a
-
Filesize
693KB
MD52be2d271d3ab4d63bb6642af32722936
SHA1c3eb0dd1d280018ab15a44c65c6b1b23dcef1552
SHA256ad58666ae0f8f9d875e47a885ac5d89fca0ac1ae65c063fd8e01f1f88acca0e9
SHA51208106cfa29b4a5f0616451e402c7cc246d7a4c3f333e18da7c73b0c7d94e06845f3c34cea570ab2afd7b3054da0a7c665b2c14a7a02d99a744cefd9c017cac9f
-
Filesize
146B
MD511825d06b9576855d5c0e89219d27ffd
SHA1851376cc5d48a3d3d62a70a4b749c80ac2e38535
SHA25612803d6965d58329a1129fc5b2739178643e2b24811f10d8131517bc4a9b1eca
SHA512290e7fb16474a352ce6f0284f3a101344aa8ca24161dac333a4784df782129e86bdfc20a578247ccdfef4caac36e6664533f1f360e20ee871d1b7faea4aa4194
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5987a0e3879a3b82dd1484d6965756722
SHA1b0f88e7f7da866dc41c0c48a9b1727f31ca406da
SHA256efa558d1de448eeeed90e575cc62846c4bdd2c641a370374f0eda493460e3850
SHA512b64fa8618cd1fb9624258d85c72ee764b3a446317a7d3d68f46345ceee852ca221a1cb23a942616b94e64c5df7deb48e0c77ff0504f9d9f2a269ebb0854155aa
-
Filesize
5KB
MD5b701d9f192ef82989296c95218e68fc6
SHA173f4f915611e668aea6facec292bbb37ee27b334
SHA256f87e2848e2c088a67365a0ac2e1a8a3825951a9205dfc8f9af218c11f25840c6
SHA5121a983ff1959b1083495b18b847c03e90efdf30a166282488b7bdfb1c933ca5aa8c54b8223081baba3ed3b354aefef87e232f0aa61865639567c810b59e633f84
-
Filesize
6KB
MD54d899c607ab606f9fa0b85a38a4a25a0
SHA195ccd3630db8473092104f6e7784695479171467
SHA25668fe898331aa483f872400a03b8f664ee2d0817a9f42ce212fec7a80cfdddf90
SHA5125dd498bf45034e40192da53e42891ee6e7b1a6ca4edfe4a6ba6f0fb00e8c49885899143d7f387b1017847dd5dfc5d167a6b8a46fda76a00410e001a22a97ecf8
-
Filesize
622KB
MD5e6bafde32b2c77cdffaf64e854b36411
SHA17483c84b4014ddc44738a94af326b0c36fc7ee20
SHA2565390cc4000f0d1d6fa105e4e18b6571913360f521cd013dd8e91cc8d93b2f0d0
SHA512260a8d4dba37846a73d7fba791d93f9abc4f441b2c828d691dc20db1d246e8aaeb99209b1a83294d44d6802aef3a1263c4fcf98fb0c92b0c70282b711930d87b
-
Filesize
622KB
MD5e6bafde32b2c77cdffaf64e854b36411
SHA17483c84b4014ddc44738a94af326b0c36fc7ee20
SHA2565390cc4000f0d1d6fa105e4e18b6571913360f521cd013dd8e91cc8d93b2f0d0
SHA512260a8d4dba37846a73d7fba791d93f9abc4f441b2c828d691dc20db1d246e8aaeb99209b1a83294d44d6802aef3a1263c4fcf98fb0c92b0c70282b711930d87b