Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2022, 23:38

General

  • Target

    831bcebe608c02152724896d42e7b83b9d8742e8e82d2836dfbac60051695e46.exe

  • Size

    2.0MB

  • MD5

    c496378505c187efc1fe9178b65c42ec

  • SHA1

    055252eda6e361dc11543e3b9735e4ba2475ab31

  • SHA256

    831bcebe608c02152724896d42e7b83b9d8742e8e82d2836dfbac60051695e46

  • SHA512

    aab772b97a7aaa2fa926c58dddf2da1e6b23a786e8381a0091fbd00da13cbea9a37dbf6ee69cf1f63afa7a9e7a069856e06c7a48134a22bf480bf9529b1be19d

  • SSDEEP

    49152:h1OsPCn3b0sdq9tVkWMq0vdovSHhXXruf:h1O3nL0sitVkWX0vVla

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\831bcebe608c02152724896d42e7b83b9d8742e8e82d2836dfbac60051695e46.exe
    "C:\Users\Admin\AppData\Local\Temp\831bcebe608c02152724896d42e7b83b9d8742e8e82d2836dfbac60051695e46.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\85DHq1cdHwocRXa.exe
      .\85DHq1cdHwocRXa.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\GoSavie\nRpqSureDyy69O.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:932
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\GoSavie\nRpqSureDyy69O.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:1160

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GoSavie\nRpqSureDyy69O.dat

    Filesize

    6KB

    MD5

    c3b68ec3f044901f240538dad0e15112

    SHA1

    a4e186da467a611950cd12b882611154215e6a4d

    SHA256

    ccc2a9d0502b2306451d904cc5bbed6b01e46d22a82d924c57b3fea18b2a4ab0

    SHA512

    8bd10ef54bfe224705403e438ac8077204843780f944d0e5ad1ff6bdf5c9aa48ba3948bd1826d18846a3b24283c8db532033adf19dd90946a220b69092734ab4

  • C:\Program Files (x86)\GoSavie\nRpqSureDyy69O.x64.dll

    Filesize

    693KB

    MD5

    2be2d271d3ab4d63bb6642af32722936

    SHA1

    c3eb0dd1d280018ab15a44c65c6b1b23dcef1552

    SHA256

    ad58666ae0f8f9d875e47a885ac5d89fca0ac1ae65c063fd8e01f1f88acca0e9

    SHA512

    08106cfa29b4a5f0616451e402c7cc246d7a4c3f333e18da7c73b0c7d94e06845f3c34cea570ab2afd7b3054da0a7c665b2c14a7a02d99a744cefd9c017cac9f

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    079722f118c7aaa4947cfadac06c25f9

    SHA1

    29b32918da07a39a960adf167f6f7cd0bd142b4d

    SHA256

    3acb373ce58c22d24352dc377356cf4c910dc2600225cb5a149139ea5cdd1d12

    SHA512

    105865572678b3127b90164e727cd6925b5e9fdf8f3b2e8c22602539f059040995cc80f945beef29ffefb8bac8bc40ae5e571a0edb8cbf25fbe8b51c9b6e5ebe

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    dd343e652d00281a61f49a497fdc1819

    SHA1

    80250dade6998558d6e212efa4dcf2afa05eff21

    SHA256

    e3639f04d10428ae43ae849c8b5b0ad078a42a62f912201a2f37203046dd3f88

    SHA512

    4b59e3ab0c2970101492b77059e933b2d504088e1a09e99fd194214120378ecb01b2d1c9b216fef0f404f4777e4bc51ce032febc0fabe6ec0af82e40a1c5dea5

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\[email protected]\install.rdf

    Filesize

    594B

    MD5

    bf3aa801a4dce4b3b87fc45724d4dbfe

    SHA1

    4d1ef9b615a94229d6af9e4b29ed9fa42fde3221

    SHA256

    d779f8e7259bc7dcf59d4fbe5351a4bdc8eed391e18afa4e7a161bc715467b89

    SHA512

    a45996378b43ded504e1b62b0acf469168209f1779c42045b17fddc6e7716573da2300b7d3e6536145f770514f9df1a5105c1a1f7380d97c1c82bf885c99fe38

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\85DHq1cdHwocRXa.dat

    Filesize

    6KB

    MD5

    c3b68ec3f044901f240538dad0e15112

    SHA1

    a4e186da467a611950cd12b882611154215e6a4d

    SHA256

    ccc2a9d0502b2306451d904cc5bbed6b01e46d22a82d924c57b3fea18b2a4ab0

    SHA512

    8bd10ef54bfe224705403e438ac8077204843780f944d0e5ad1ff6bdf5c9aa48ba3948bd1826d18846a3b24283c8db532033adf19dd90946a220b69092734ab4

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\85DHq1cdHwocRXa.exe

    Filesize

    622KB

    MD5

    e6bafde32b2c77cdffaf64e854b36411

    SHA1

    7483c84b4014ddc44738a94af326b0c36fc7ee20

    SHA256

    5390cc4000f0d1d6fa105e4e18b6571913360f521cd013dd8e91cc8d93b2f0d0

    SHA512

    260a8d4dba37846a73d7fba791d93f9abc4f441b2c828d691dc20db1d246e8aaeb99209b1a83294d44d6802aef3a1263c4fcf98fb0c92b0c70282b711930d87b

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\85DHq1cdHwocRXa.exe

    Filesize

    622KB

    MD5

    e6bafde32b2c77cdffaf64e854b36411

    SHA1

    7483c84b4014ddc44738a94af326b0c36fc7ee20

    SHA256

    5390cc4000f0d1d6fa105e4e18b6571913360f521cd013dd8e91cc8d93b2f0d0

    SHA512

    260a8d4dba37846a73d7fba791d93f9abc4f441b2c828d691dc20db1d246e8aaeb99209b1a83294d44d6802aef3a1263c4fcf98fb0c92b0c70282b711930d87b

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\ldoiflgnhkplgafcoahokbnbnickddjd\P1b.js

    Filesize

    5KB

    MD5

    24f37272eba688d245f20d7e09361850

    SHA1

    062965a7da6c48a2e43a851c3d15079ac6ed4d1c

    SHA256

    1a42409993141a792fb452009978969be3eb41d3ec6b38d8e9a9a21b0d34834e

    SHA512

    09bcf1edac465af85d6a0fde94f763e147aed2e2087fc6f45ef5ff2852e824b4bcd004d6778ac67383c220c6e05c9687babd55afdb3a8ecf6c7ab88b24987c29

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\ldoiflgnhkplgafcoahokbnbnickddjd\background.html

    Filesize

    140B

    MD5

    15b2b34004b02f24d405919691f7e0f9

    SHA1

    7cd3475ea58d6d004bcdb20225bedf70ff0b6f88

    SHA256

    29d7dff47ce7a5fadc5a30ec3d0e03a6190535c0b4b9fa0e37af23d2e00a3d9f

    SHA512

    0b32397e533b8fb4f009a9db74e514e15d6d29c197a3c2f82655924b9d77f179735baff09ccf05e0329cdf5da30fbad6afe5fe81e0ebf6e056b1e0a91e93191f

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\ldoiflgnhkplgafcoahokbnbnickddjd\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\ldoiflgnhkplgafcoahokbnbnickddjd\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\ldoiflgnhkplgafcoahokbnbnickddjd\manifest.json

    Filesize

    499B

    MD5

    8027905a1370c51fd23dba365f35d24d

    SHA1

    8f75dfcef1a163258d2326df69018b6ebddb1066

    SHA256

    5b3fb11f4fb38761aa64713eafc884ca2443a006396e4eb95b2385311bf01648

    SHA512

    a35e107f0a191b0469e56d715403884f81bdda5804c30be1cc21c8c6cedc25417350182a01dd1de63aa1142fd0a81007eddc5b0730f1e05479ea9a3226c61336

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\nRpqSureDyy69O.dll

    Filesize

    613KB

    MD5

    c547ac330285a0ea3ab373fbf632e095

    SHA1

    1c7a20d9bf6104c3c3343f0c4061107441348787

    SHA256

    8ad6a8d9db588353ff1cb777ac8b7f62b6a8976d2ed396e8816051ffc69c8db0

    SHA512

    b695eddc8d688d61b55a87d6153084836bb8c699a0e9b2834c77fed923e1ffa6da8871df569310668eff2161eb219eec8193bfcf812d9932f1ae064953d1b9a2

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\nRpqSureDyy69O.tlb

    Filesize

    3KB

    MD5

    b09701113a6fa6b7ce61cef1f5b3dc70

    SHA1

    752190cbbd25d899b48f6fc2caa9cedd3baff7df

    SHA256

    a8a8b11da1822ce3d93baa6d3711969425dd4ccbe05bf348899320659b07e9d1

    SHA512

    9436a606e8ced02094374e5d603bc4bfb63a079259fa10c1fd82b9a30c40fa64c54b4bc3f7d5c0634dc4584c18e3accadd5df536e37367a7b3ea9f6597eb547a

  • C:\Users\Admin\AppData\Local\Temp\7zSA00.tmp\nRpqSureDyy69O.x64.dll

    Filesize

    693KB

    MD5

    2be2d271d3ab4d63bb6642af32722936

    SHA1

    c3eb0dd1d280018ab15a44c65c6b1b23dcef1552

    SHA256

    ad58666ae0f8f9d875e47a885ac5d89fca0ac1ae65c063fd8e01f1f88acca0e9

    SHA512

    08106cfa29b4a5f0616451e402c7cc246d7a4c3f333e18da7c73b0c7d94e06845f3c34cea570ab2afd7b3054da0a7c665b2c14a7a02d99a744cefd9c017cac9f

  • \Program Files (x86)\GoSavie\nRpqSureDyy69O.dll

    Filesize

    613KB

    MD5

    c547ac330285a0ea3ab373fbf632e095

    SHA1

    1c7a20d9bf6104c3c3343f0c4061107441348787

    SHA256

    8ad6a8d9db588353ff1cb777ac8b7f62b6a8976d2ed396e8816051ffc69c8db0

    SHA512

    b695eddc8d688d61b55a87d6153084836bb8c699a0e9b2834c77fed923e1ffa6da8871df569310668eff2161eb219eec8193bfcf812d9932f1ae064953d1b9a2

  • \Program Files (x86)\GoSavie\nRpqSureDyy69O.x64.dll

    Filesize

    693KB

    MD5

    2be2d271d3ab4d63bb6642af32722936

    SHA1

    c3eb0dd1d280018ab15a44c65c6b1b23dcef1552

    SHA256

    ad58666ae0f8f9d875e47a885ac5d89fca0ac1ae65c063fd8e01f1f88acca0e9

    SHA512

    08106cfa29b4a5f0616451e402c7cc246d7a4c3f333e18da7c73b0c7d94e06845f3c34cea570ab2afd7b3054da0a7c665b2c14a7a02d99a744cefd9c017cac9f

  • \Program Files (x86)\GoSavie\nRpqSureDyy69O.x64.dll

    Filesize

    693KB

    MD5

    2be2d271d3ab4d63bb6642af32722936

    SHA1

    c3eb0dd1d280018ab15a44c65c6b1b23dcef1552

    SHA256

    ad58666ae0f8f9d875e47a885ac5d89fca0ac1ae65c063fd8e01f1f88acca0e9

    SHA512

    08106cfa29b4a5f0616451e402c7cc246d7a4c3f333e18da7c73b0c7d94e06845f3c34cea570ab2afd7b3054da0a7c665b2c14a7a02d99a744cefd9c017cac9f

  • \Users\Admin\AppData\Local\Temp\7zSA00.tmp\85DHq1cdHwocRXa.exe

    Filesize

    622KB

    MD5

    e6bafde32b2c77cdffaf64e854b36411

    SHA1

    7483c84b4014ddc44738a94af326b0c36fc7ee20

    SHA256

    5390cc4000f0d1d6fa105e4e18b6571913360f521cd013dd8e91cc8d93b2f0d0

    SHA512

    260a8d4dba37846a73d7fba791d93f9abc4f441b2c828d691dc20db1d246e8aaeb99209b1a83294d44d6802aef3a1263c4fcf98fb0c92b0c70282b711930d87b

  • memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

    Filesize

    8KB

  • memory/1160-78-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

    Filesize

    8KB