Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
90731b2ac4e593a50bcd392f629f19e0062bbf20fbba88608bac32aa3b583118.exe
Resource
win7-20220812-en
General
-
Target
90731b2ac4e593a50bcd392f629f19e0062bbf20fbba88608bac32aa3b583118.exe
-
Size
770KB
-
MD5
0aaf6d006ce4fc4c2ab70177a56462e3
-
SHA1
98753148cef1e17322cb67cab0f78d09bbbc1951
-
SHA256
90731b2ac4e593a50bcd392f629f19e0062bbf20fbba88608bac32aa3b583118
-
SHA512
8729bb35457e38ce93067cfe4494006e6bf3deee25fb52c8ad276bd68164ddc5cd7f26f7cdff4f9613e3f8c31aa0d4a558f14b23abe59a9bd4dc91c0a7a4fc0c
-
SSDEEP
24576:h1OYdaO/GiAEAd/KjjBKyu73i8mxcmMMV6zs+G/U:h1OscMAd/OxfV6zZG8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2000 AsjMWVXKwn0RjtP.exe -
Loads dropped DLL 1 IoCs
pid Process 816 90731b2ac4e593a50bcd392f629f19e0062bbf20fbba88608bac32aa3b583118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
description ioc Process File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\oajmcmcpiboagipoflploplebgicaadj\152\manifest.json AsjMWVXKwn0RjtP.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\oajmcmcpiboagipoflploplebgicaadj\152\manifest.json AsjMWVXKwn0RjtP.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oajmcmcpiboagipoflploplebgicaadj\152\manifest.json AsjMWVXKwn0RjtP.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 816 wrote to memory of 2000 816 90731b2ac4e593a50bcd392f629f19e0062bbf20fbba88608bac32aa3b583118.exe 27 PID 816 wrote to memory of 2000 816 90731b2ac4e593a50bcd392f629f19e0062bbf20fbba88608bac32aa3b583118.exe 27 PID 816 wrote to memory of 2000 816 90731b2ac4e593a50bcd392f629f19e0062bbf20fbba88608bac32aa3b583118.exe 27 PID 816 wrote to memory of 2000 816 90731b2ac4e593a50bcd392f629f19e0062bbf20fbba88608bac32aa3b583118.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\90731b2ac4e593a50bcd392f629f19e0062bbf20fbba88608bac32aa3b583118.exe"C:\Users\Admin\AppData\Local\Temp\90731b2ac4e593a50bcd392f629f19e0062bbf20fbba88608bac32aa3b583118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\7zS455.tmp\AsjMWVXKwn0RjtP.exe.\AsjMWVXKwn0RjtP.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
PID:2000
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d456756dcaa7e8860ed6c07977af12e4
SHA1187d138f1b54b98702ae187fcaf0a06fee74e81f
SHA256df1745d674167c97f425145143b53ec4bd3ce60602b659f10b35441e85b5904a
SHA512ea0e2bba29fbdc5f672c34544c888bc96ef6ef767e6c385dbb2d4a68c370063f7bf46ce49c01d02f3b527a370167135134cdfd3feffae9c1c28b045aaa392df0
-
Filesize
623KB
MD5cd6bf363f5af45a16926343310023db4
SHA1e5bcbe9735e5a8d6243af1c2a4593784e8e63aa6
SHA256bfa98e4e677c8bcb7348aed64d51915e3bacb05925d0234e646e2bb7cc3cdd06
SHA5123ccb2c4ea143ac58d4df43751bf1c8781795b2321f3acb5d85a0249e4b43c1bf3f93c41c0c59cc2933b923069340a3f7425e9ddce1d7355e60eec843d9158ced
-
Filesize
6KB
MD56ede6b8e90ce2d9c9930d6834501dacb
SHA101ed2c237eebc94c121c5e7b6eec2d29e14fa645
SHA256db3ccc2226138d9c05eee796a90012b6eebd106b5ab2ed36348743af172f1f2d
SHA5125a6f0dd388778eaf81556310698650b17acb6ccd592af9bc7a3165b39278c60bb32c65338bf1576a7b82fe5e94425a674ac5dda0256eb96975e0952ccdebf50d
-
Filesize
138B
MD5699f62f61f5a144d9154daa748a18abc
SHA1e688ffa801968a547ebda17e616702323777c04b
SHA2565f624995f9af114785dbf4c353f63d1756d97e716b18ed64cff80a083ca63796
SHA512bd4b48c4109d896ef1ce14780dd041582fc1ddde212d7cac69bd13ae6d54786fd79726f5d25503066471cb88cbb8ca2f760acbb825b568033c9eb7293394c54c
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
600B
MD587b979a1f988d4824e26167f5c26a20f
SHA1622b9d1f1dd2c216291bf174660497b53ba6fa6a
SHA256228e192ffdcb9c04dae53b1ee6a997e3b28406e974b7b18218faf3ead25e88b0
SHA512b3c0106f6b8c162c0958f233d4a50dc3a5326fd5c263f86bc2b3763522c8eff83c9a01661b10b206b8d12f315c19814297b1b8cb0ceb7420f0ef6a277b9d978f
-
Filesize
623KB
MD5cd6bf363f5af45a16926343310023db4
SHA1e5bcbe9735e5a8d6243af1c2a4593784e8e63aa6
SHA256bfa98e4e677c8bcb7348aed64d51915e3bacb05925d0234e646e2bb7cc3cdd06
SHA5123ccb2c4ea143ac58d4df43751bf1c8781795b2321f3acb5d85a0249e4b43c1bf3f93c41c0c59cc2933b923069340a3f7425e9ddce1d7355e60eec843d9158ced