Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    6s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 04:55

General

  • Target

    b290a371ec05c2194ab6f07ae8ae8a3d8958fdfa9efa7da820c453ec689261f8.exe

  • Size

    2.1MB

  • MD5

    8a19b2e00c37c605c0f0bd1bf61a963c

  • SHA1

    2f3ac34d75f515c351bb5303a645a4df6c8e2c24

  • SHA256

    b290a371ec05c2194ab6f07ae8ae8a3d8958fdfa9efa7da820c453ec689261f8

  • SHA512

    90c1d9f3d1946e6876e3b41606ebe597ecea5730bba69c2d9732ed1af385068d28da1b904490b37bb1f5d58db5b5254accfb17bca28df3ae0d50692f04cfece5

  • SSDEEP

    24576:h1OYdaODNVGiAEAd/KjjBKyu73i8mxcmMMV6zs+G/pC2d1RJoTJnQqphTuS2MD3W:h1Os4MAd/OxfV6zZGYg1RJQnFrTc2Sh

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b290a371ec05c2194ab6f07ae8ae8a3d8958fdfa9efa7da820c453ec689261f8.exe
    "C:\Users\Admin\AppData\Local\Temp\b290a371ec05c2194ab6f07ae8ae8a3d8958fdfa9efa7da820c453ec689261f8.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\fg0ojl0WjYx5kjK.exe
      .\fg0ojl0WjYx5kjK.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:892
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:1620

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.dat

    Filesize

    7KB

    MD5

    efe8cc94f1a0e69fd594e849fcf0caba

    SHA1

    012771a864eaed5065cd2670f0950e5febb1af9a

    SHA256

    3a49d5ead2f8f4cd23a9e273ccc1421d899e8ba2084d34b2f7df471145811c71

    SHA512

    9593618fd90c1f734fc8cba28abc2564dc848e46a0ae7f2ce84f4b1d7fc85aa1a40c4675950e81bfd0364b6e14dcbedabf14249665731d4d4a128627efd38a76

  • C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.x64.dll

    Filesize

    702KB

    MD5

    1287246338d36f26f77735bd58d74e70

    SHA1

    aabda37cd307e50f2444c73bd656eaf2b78fc291

    SHA256

    4d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1

    SHA512

    ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\VpbWPJRbcQ313a.dll

    Filesize

    619KB

    MD5

    4f328f4e17a2c81830aac4c8c3d67141

    SHA1

    063c8e33d6a263dd604d072ffd143305f6c3d4a8

    SHA256

    303917029755e7a44a6e7392c5e751e4fbcb66feaa8a5f09142efaf5a91ad2fc

    SHA512

    d387cf9ee95426717be8bac7a6cd422b8ddc2aa925723a9b25a169d9b4a0f5cb5607e2f2b8161cadb0e4333d1fda4ba24ecb838dbb49571d55a6799efce404c0

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\VpbWPJRbcQ313a.tlb

    Filesize

    3KB

    MD5

    62cb4133d9d3a46f4f1c6c0fb3688619

    SHA1

    feaaef6e2b8c41be2575d0763cc8de3e8c19478e

    SHA256

    3ddcfb4b206fc4856f5bb5c06bcc3761dde53882eea20b5dc5ddf4ee8864bea5

    SHA512

    cb30dc73d52eb502f745fe32b4055b53306f62f0847cae1275d0856608949ea62c30f40d7f252ad450909a4bd425cf0e50012400175cc42a4096cf1451d90123

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\VpbWPJRbcQ313a.x64.dll

    Filesize

    702KB

    MD5

    1287246338d36f26f77735bd58d74e70

    SHA1

    aabda37cd307e50f2444c73bd656eaf2b78fc291

    SHA256

    4d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1

    SHA512

    ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\fg0ojl0WjYx5kjK.dat

    Filesize

    7KB

    MD5

    efe8cc94f1a0e69fd594e849fcf0caba

    SHA1

    012771a864eaed5065cd2670f0950e5febb1af9a

    SHA256

    3a49d5ead2f8f4cd23a9e273ccc1421d899e8ba2084d34b2f7df471145811c71

    SHA512

    9593618fd90c1f734fc8cba28abc2564dc848e46a0ae7f2ce84f4b1d7fc85aa1a40c4675950e81bfd0364b6e14dcbedabf14249665731d4d4a128627efd38a76

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\fg0ojl0WjYx5kjK.exe

    Filesize

    623KB

    MD5

    cd6bf363f5af45a16926343310023db4

    SHA1

    e5bcbe9735e5a8d6243af1c2a4593784e8e63aa6

    SHA256

    bfa98e4e677c8bcb7348aed64d51915e3bacb05925d0234e646e2bb7cc3cdd06

    SHA512

    3ccb2c4ea143ac58d4df43751bf1c8781795b2321f3acb5d85a0249e4b43c1bf3f93c41c0c59cc2933b923069340a3f7425e9ddce1d7355e60eec843d9158ced

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\fg0ojl0WjYx5kjK.exe

    Filesize

    623KB

    MD5

    cd6bf363f5af45a16926343310023db4

    SHA1

    e5bcbe9735e5a8d6243af1c2a4593784e8e63aa6

    SHA256

    bfa98e4e677c8bcb7348aed64d51915e3bacb05925d0234e646e2bb7cc3cdd06

    SHA512

    3ccb2c4ea143ac58d4df43751bf1c8781795b2321f3acb5d85a0249e4b43c1bf3f93c41c0c59cc2933b923069340a3f7425e9ddce1d7355e60eec843d9158ced

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\jgkpadkkpjochalhekpcnggjhikehiak\QVmkoZ.js

    Filesize

    6KB

    MD5

    4299d6ee58d7bfa28430dd995826696f

    SHA1

    121d8eea2084a0b437988dab04ebdcec97a73e68

    SHA256

    659b1b7ff73228054bdcaa48bd77bda68854be11955d880dc187f48fbcd9e0e5

    SHA512

    b69ae667fa1395de5b2656dbea15e1640cf4cc8de38520918e7155dd363ad193d46331936de153854a7423fd850b47b61e3024d4e8a54ef6c96ee2ed5552aace

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\jgkpadkkpjochalhekpcnggjhikehiak\background.html

    Filesize

    143B

    MD5

    803cb16439c8eb20a802ca7eb191f5da

    SHA1

    33dedbce2fa2dc5a87ffbd4d7c3af206dd8fdd54

    SHA256

    870f5ba66d9b588a3c88e17e7f5b338b6ec82b8a87f5fe019989dff360bb6341

    SHA512

    6907b56c571a72e9530cf958ab705342615af704eebd9b0410d66d956a93dac77e92690db50065c7b7205875758a0609300b1450775f27efd4376f9d4c3d3261

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\jgkpadkkpjochalhekpcnggjhikehiak\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\jgkpadkkpjochalhekpcnggjhikehiak\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\jgkpadkkpjochalhekpcnggjhikehiak\manifest.json

    Filesize

    498B

    MD5

    9c063207e18b4be1aa2c9ba76ca4c114

    SHA1

    4aab780004676fc68f2cd767d295f0e1a4cec20d

    SHA256

    d79b9a4c151ffc381d8ee3b76e33bf41af5ae6d581b485be74158444617f946a

    SHA512

    7ed695c39c000253f53716ad422acd9e65dc0e65756668a2757473690104089640b564d71e09a9d9565d647ac7f84b8dc338ff6df0554b67ee0593e6b9002928

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    2079d835165da7a4cd6bd48714d4c9a2

    SHA1

    c531f99942da2bc99eb5ab4b49114d46cb7ecaaa

    SHA256

    2003bf01b297e36d6f03184a29b33f70b5e5e26125e864a9b96587f7ca9989f7

    SHA512

    38f1daae60cc8e178eab727ef0fc3bd41f15ead5dbee5f3eb5f03d43275785bb605b92778098ef72a327852478e668a5842897b5f64028b6ed69a2bae31a97cc

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\[email protected]\content\bg.js

    Filesize

    9KB

    MD5

    2573de2c72da5918475520c846a4173d

    SHA1

    acfc9e7cd458e65456328e3387110cb6a0cdd777

    SHA256

    cf99f45e3e097c0c6ba129de16cc50c22fc2b592bb5ceeb55e5f119e9b3360a4

    SHA512

    7074d7ef380ac9156be8a59c6a1d2ba45b41b51639cf07a6ce37e67da854a2a0617b072366b556aa13b533c8909302a5417b25733b0e451bdd444e949b87f443

  • C:\Users\Admin\AppData\Local\Temp\7zS644F.tmp\[email protected]\install.rdf

    Filesize

    592B

    MD5

    0201a14372b494000057df24b37bc314

    SHA1

    177ce4c9ddc36fa800f6f58b7ed11339e1e6771a

    SHA256

    edaa7e102285b7e20052a35cfbef343b481980db189cd592cc70ac6c8e1dbd38

    SHA512

    750ee8b675d7fa15576f52ee30cd11769a05255c247ad0ad99a0394b78b393c871a0ea0bef6dc56fe7fd60053965221962eec3c1a6682e51542abc96c50db395

  • \Program Files (x86)\GoSavE\VpbWPJRbcQ313a.dll

    Filesize

    619KB

    MD5

    4f328f4e17a2c81830aac4c8c3d67141

    SHA1

    063c8e33d6a263dd604d072ffd143305f6c3d4a8

    SHA256

    303917029755e7a44a6e7392c5e751e4fbcb66feaa8a5f09142efaf5a91ad2fc

    SHA512

    d387cf9ee95426717be8bac7a6cd422b8ddc2aa925723a9b25a169d9b4a0f5cb5607e2f2b8161cadb0e4333d1fda4ba24ecb838dbb49571d55a6799efce404c0

  • \Program Files (x86)\GoSavE\VpbWPJRbcQ313a.x64.dll

    Filesize

    702KB

    MD5

    1287246338d36f26f77735bd58d74e70

    SHA1

    aabda37cd307e50f2444c73bd656eaf2b78fc291

    SHA256

    4d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1

    SHA512

    ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1

  • \Program Files (x86)\GoSavE\VpbWPJRbcQ313a.x64.dll

    Filesize

    702KB

    MD5

    1287246338d36f26f77735bd58d74e70

    SHA1

    aabda37cd307e50f2444c73bd656eaf2b78fc291

    SHA256

    4d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1

    SHA512

    ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1

  • \Users\Admin\AppData\Local\Temp\7zS644F.tmp\fg0ojl0WjYx5kjK.exe

    Filesize

    623KB

    MD5

    cd6bf363f5af45a16926343310023db4

    SHA1

    e5bcbe9735e5a8d6243af1c2a4593784e8e63aa6

    SHA256

    bfa98e4e677c8bcb7348aed64d51915e3bacb05925d0234e646e2bb7cc3cdd06

    SHA512

    3ccb2c4ea143ac58d4df43751bf1c8781795b2321f3acb5d85a0249e4b43c1bf3f93c41c0c59cc2933b923069340a3f7425e9ddce1d7355e60eec843d9158ced

  • memory/1240-54-0x0000000076221000-0x0000000076223000-memory.dmp

    Filesize

    8KB

  • memory/1620-78-0x000007FEFC261000-0x000007FEFC263000-memory.dmp

    Filesize

    8KB