Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    196s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2022, 04:55

General

  • Target

    b290a371ec05c2194ab6f07ae8ae8a3d8958fdfa9efa7da820c453ec689261f8.exe

  • Size

    2.1MB

  • MD5

    8a19b2e00c37c605c0f0bd1bf61a963c

  • SHA1

    2f3ac34d75f515c351bb5303a645a4df6c8e2c24

  • SHA256

    b290a371ec05c2194ab6f07ae8ae8a3d8958fdfa9efa7da820c453ec689261f8

  • SHA512

    90c1d9f3d1946e6876e3b41606ebe597ecea5730bba69c2d9732ed1af385068d28da1b904490b37bb1f5d58db5b5254accfb17bca28df3ae0d50692f04cfece5

  • SSDEEP

    24576:h1OYdaODNVGiAEAd/KjjBKyu73i8mxcmMMV6zs+G/pC2d1RJoTJnQqphTuS2MD3W:h1Os4MAd/OxfV6zZGYg1RJQnFrTc2Sh

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b290a371ec05c2194ab6f07ae8ae8a3d8958fdfa9efa7da820c453ec689261f8.exe
    "C:\Users\Admin\AppData\Local\Temp\b290a371ec05c2194ab6f07ae8ae8a3d8958fdfa9efa7da820c453ec689261f8.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\fg0ojl0WjYx5kjK.exe
      .\fg0ojl0WjYx5kjK.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3832
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4072
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:4676
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:3480
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:4388

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.dat

        Filesize

        7KB

        MD5

        efe8cc94f1a0e69fd594e849fcf0caba

        SHA1

        012771a864eaed5065cd2670f0950e5febb1af9a

        SHA256

        3a49d5ead2f8f4cd23a9e273ccc1421d899e8ba2084d34b2f7df471145811c71

        SHA512

        9593618fd90c1f734fc8cba28abc2564dc848e46a0ae7f2ce84f4b1d7fc85aa1a40c4675950e81bfd0364b6e14dcbedabf14249665731d4d4a128627efd38a76

      • C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.dll

        Filesize

        619KB

        MD5

        4f328f4e17a2c81830aac4c8c3d67141

        SHA1

        063c8e33d6a263dd604d072ffd143305f6c3d4a8

        SHA256

        303917029755e7a44a6e7392c5e751e4fbcb66feaa8a5f09142efaf5a91ad2fc

        SHA512

        d387cf9ee95426717be8bac7a6cd422b8ddc2aa925723a9b25a169d9b4a0f5cb5607e2f2b8161cadb0e4333d1fda4ba24ecb838dbb49571d55a6799efce404c0

      • C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.x64.dll

        Filesize

        702KB

        MD5

        1287246338d36f26f77735bd58d74e70

        SHA1

        aabda37cd307e50f2444c73bd656eaf2b78fc291

        SHA256

        4d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1

        SHA512

        ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1

      • C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.x64.dll

        Filesize

        702KB

        MD5

        1287246338d36f26f77735bd58d74e70

        SHA1

        aabda37cd307e50f2444c73bd656eaf2b78fc291

        SHA256

        4d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1

        SHA512

        ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1

      • C:\Program Files (x86)\GoSavE\VpbWPJRbcQ313a.x64.dll

        Filesize

        702KB

        MD5

        1287246338d36f26f77735bd58d74e70

        SHA1

        aabda37cd307e50f2444c73bd656eaf2b78fc291

        SHA256

        4d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1

        SHA512

        ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\VpbWPJRbcQ313a.dll

        Filesize

        619KB

        MD5

        4f328f4e17a2c81830aac4c8c3d67141

        SHA1

        063c8e33d6a263dd604d072ffd143305f6c3d4a8

        SHA256

        303917029755e7a44a6e7392c5e751e4fbcb66feaa8a5f09142efaf5a91ad2fc

        SHA512

        d387cf9ee95426717be8bac7a6cd422b8ddc2aa925723a9b25a169d9b4a0f5cb5607e2f2b8161cadb0e4333d1fda4ba24ecb838dbb49571d55a6799efce404c0

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\VpbWPJRbcQ313a.tlb

        Filesize

        3KB

        MD5

        62cb4133d9d3a46f4f1c6c0fb3688619

        SHA1

        feaaef6e2b8c41be2575d0763cc8de3e8c19478e

        SHA256

        3ddcfb4b206fc4856f5bb5c06bcc3761dde53882eea20b5dc5ddf4ee8864bea5

        SHA512

        cb30dc73d52eb502f745fe32b4055b53306f62f0847cae1275d0856608949ea62c30f40d7f252ad450909a4bd425cf0e50012400175cc42a4096cf1451d90123

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\VpbWPJRbcQ313a.x64.dll

        Filesize

        702KB

        MD5

        1287246338d36f26f77735bd58d74e70

        SHA1

        aabda37cd307e50f2444c73bd656eaf2b78fc291

        SHA256

        4d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1

        SHA512

        ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\fg0ojl0WjYx5kjK.dat

        Filesize

        7KB

        MD5

        efe8cc94f1a0e69fd594e849fcf0caba

        SHA1

        012771a864eaed5065cd2670f0950e5febb1af9a

        SHA256

        3a49d5ead2f8f4cd23a9e273ccc1421d899e8ba2084d34b2f7df471145811c71

        SHA512

        9593618fd90c1f734fc8cba28abc2564dc848e46a0ae7f2ce84f4b1d7fc85aa1a40c4675950e81bfd0364b6e14dcbedabf14249665731d4d4a128627efd38a76

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\fg0ojl0WjYx5kjK.exe

        Filesize

        623KB

        MD5

        cd6bf363f5af45a16926343310023db4

        SHA1

        e5bcbe9735e5a8d6243af1c2a4593784e8e63aa6

        SHA256

        bfa98e4e677c8bcb7348aed64d51915e3bacb05925d0234e646e2bb7cc3cdd06

        SHA512

        3ccb2c4ea143ac58d4df43751bf1c8781795b2321f3acb5d85a0249e4b43c1bf3f93c41c0c59cc2933b923069340a3f7425e9ddce1d7355e60eec843d9158ced

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\fg0ojl0WjYx5kjK.exe

        Filesize

        623KB

        MD5

        cd6bf363f5af45a16926343310023db4

        SHA1

        e5bcbe9735e5a8d6243af1c2a4593784e8e63aa6

        SHA256

        bfa98e4e677c8bcb7348aed64d51915e3bacb05925d0234e646e2bb7cc3cdd06

        SHA512

        3ccb2c4ea143ac58d4df43751bf1c8781795b2321f3acb5d85a0249e4b43c1bf3f93c41c0c59cc2933b923069340a3f7425e9ddce1d7355e60eec843d9158ced

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\jgkpadkkpjochalhekpcnggjhikehiak\QVmkoZ.js

        Filesize

        6KB

        MD5

        4299d6ee58d7bfa28430dd995826696f

        SHA1

        121d8eea2084a0b437988dab04ebdcec97a73e68

        SHA256

        659b1b7ff73228054bdcaa48bd77bda68854be11955d880dc187f48fbcd9e0e5

        SHA512

        b69ae667fa1395de5b2656dbea15e1640cf4cc8de38520918e7155dd363ad193d46331936de153854a7423fd850b47b61e3024d4e8a54ef6c96ee2ed5552aace

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\jgkpadkkpjochalhekpcnggjhikehiak\background.html

        Filesize

        143B

        MD5

        803cb16439c8eb20a802ca7eb191f5da

        SHA1

        33dedbce2fa2dc5a87ffbd4d7c3af206dd8fdd54

        SHA256

        870f5ba66d9b588a3c88e17e7f5b338b6ec82b8a87f5fe019989dff360bb6341

        SHA512

        6907b56c571a72e9530cf958ab705342615af704eebd9b0410d66d956a93dac77e92690db50065c7b7205875758a0609300b1450775f27efd4376f9d4c3d3261

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\jgkpadkkpjochalhekpcnggjhikehiak\content.js

        Filesize

        144B

        MD5

        fca19198fd8af21016a8b1dec7980002

        SHA1

        fd01a47d14004e17a625efe66cc46a06c786cf40

        SHA256

        332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

        SHA512

        60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\jgkpadkkpjochalhekpcnggjhikehiak\lsdb.js

        Filesize

        531B

        MD5

        36d98318ab2b3b2585a30984db328afb

        SHA1

        f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

        SHA256

        ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

        SHA512

        6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\jgkpadkkpjochalhekpcnggjhikehiak\manifest.json

        Filesize

        498B

        MD5

        9c063207e18b4be1aa2c9ba76ca4c114

        SHA1

        4aab780004676fc68f2cd767d295f0e1a4cec20d

        SHA256

        d79b9a4c151ffc381d8ee3b76e33bf41af5ae6d581b485be74158444617f946a

        SHA512

        7ed695c39c000253f53716ad422acd9e65dc0e65756668a2757473690104089640b564d71e09a9d9565d647ac7f84b8dc338ff6df0554b67ee0593e6b9002928

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\[email protected]\bootstrap.js

        Filesize

        2KB

        MD5

        df13f711e20e9c80171846d4f2f7ae06

        SHA1

        56d29cda58427efe0e21d3880d39eb1b0ef60bee

        SHA256

        6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

        SHA512

        6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\[email protected]\chrome.manifest

        Filesize

        35B

        MD5

        2079d835165da7a4cd6bd48714d4c9a2

        SHA1

        c531f99942da2bc99eb5ab4b49114d46cb7ecaaa

        SHA256

        2003bf01b297e36d6f03184a29b33f70b5e5e26125e864a9b96587f7ca9989f7

        SHA512

        38f1daae60cc8e178eab727ef0fc3bd41f15ead5dbee5f3eb5f03d43275785bb605b92778098ef72a327852478e668a5842897b5f64028b6ed69a2bae31a97cc

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\[email protected]\content\bg.js

        Filesize

        9KB

        MD5

        2573de2c72da5918475520c846a4173d

        SHA1

        acfc9e7cd458e65456328e3387110cb6a0cdd777

        SHA256

        cf99f45e3e097c0c6ba129de16cc50c22fc2b592bb5ceeb55e5f119e9b3360a4

        SHA512

        7074d7ef380ac9156be8a59c6a1d2ba45b41b51639cf07a6ce37e67da854a2a0617b072366b556aa13b533c8909302a5417b25733b0e451bdd444e949b87f443

      • C:\Users\Admin\AppData\Local\Temp\7zS28A6.tmp\[email protected]\install.rdf

        Filesize

        592B

        MD5

        0201a14372b494000057df24b37bc314

        SHA1

        177ce4c9ddc36fa800f6f58b7ed11339e1e6771a

        SHA256

        edaa7e102285b7e20052a35cfbef343b481980db189cd592cc70ac6c8e1dbd38

        SHA512

        750ee8b675d7fa15576f52ee30cd11769a05255c247ad0ad99a0394b78b393c871a0ea0bef6dc56fe7fd60053965221962eec3c1a6682e51542abc96c50db395