Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
8fb1c183032cfdb44270837d4750c35fa3f5a66f8955b8525f5f6d6ec48cab6f.exe
Resource
win7-20221111-en
General
-
Target
8fb1c183032cfdb44270837d4750c35fa3f5a66f8955b8525f5f6d6ec48cab6f.exe
-
Size
2.1MB
-
MD5
12807cc0deace4e091db537f3361971d
-
SHA1
8071f5758003cfb7bf97c963c99da2e174efa5c6
-
SHA256
8fb1c183032cfdb44270837d4750c35fa3f5a66f8955b8525f5f6d6ec48cab6f
-
SHA512
e3ecc58cccb0d8a6d1f64d6da9084b424d83ce9793e1de22321ecd89d35021d5eede1a313d2df32f2580a3ce2c4136ee53efc31856a4216b45dbc9fa59bb018d
-
SSDEEP
24576:h1OYdaOxGiAEAd/KjjBKyu73i8mxcmMMV6zs+G/pC2d1RJoTJnQqphTuS2MD3GvG:h1OsiMAd/OxfV6zZGYg1RJQnFrTc2Sk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4040 xrWaIgm8T5Pv2Qv.exe -
Loads dropped DLL 3 IoCs
pid Process 4040 xrWaIgm8T5Pv2Qv.exe 3700 regsvr32.exe 4912 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjahhlhdamgllcpgdjhgbpmajpiinlen\2.0\manifest.json xrWaIgm8T5Pv2Qv.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjahhlhdamgllcpgdjhgbpmajpiinlen\2.0\manifest.json xrWaIgm8T5Pv2Qv.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjahhlhdamgllcpgdjhgbpmajpiinlen\2.0\manifest.json xrWaIgm8T5Pv2Qv.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjahhlhdamgllcpgdjhgbpmajpiinlen\2.0\manifest.json xrWaIgm8T5Pv2Qv.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjahhlhdamgllcpgdjhgbpmajpiinlen\2.0\manifest.json xrWaIgm8T5Pv2Qv.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} xrWaIgm8T5Pv2Qv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} xrWaIgm8T5Pv2Qv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects xrWaIgm8T5Pv2Qv.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ xrWaIgm8T5Pv2Qv.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy xrWaIgm8T5Pv2Qv.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini xrWaIgm8T5Pv2Qv.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol xrWaIgm8T5Pv2Qv.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI xrWaIgm8T5Pv2Qv.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\GooSavve\Sie7JZQQLvfsqE.x64.dll xrWaIgm8T5Pv2Qv.exe File opened for modification C:\Program Files (x86)\GooSavve\Sie7JZQQLvfsqE.x64.dll xrWaIgm8T5Pv2Qv.exe File created C:\Program Files (x86)\GooSavve\Sie7JZQQLvfsqE.dll xrWaIgm8T5Pv2Qv.exe File opened for modification C:\Program Files (x86)\GooSavve\Sie7JZQQLvfsqE.dll xrWaIgm8T5Pv2Qv.exe File created C:\Program Files (x86)\GooSavve\Sie7JZQQLvfsqE.tlb xrWaIgm8T5Pv2Qv.exe File opened for modification C:\Program Files (x86)\GooSavve\Sie7JZQQLvfsqE.tlb xrWaIgm8T5Pv2Qv.exe File created C:\Program Files (x86)\GooSavve\Sie7JZQQLvfsqE.dat xrWaIgm8T5Pv2Qv.exe File opened for modification C:\Program Files (x86)\GooSavve\Sie7JZQQLvfsqE.dat xrWaIgm8T5Pv2Qv.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4040 xrWaIgm8T5Pv2Qv.exe 4040 xrWaIgm8T5Pv2Qv.exe 4040 xrWaIgm8T5Pv2Qv.exe 4040 xrWaIgm8T5Pv2Qv.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4572 wrote to memory of 4040 4572 8fb1c183032cfdb44270837d4750c35fa3f5a66f8955b8525f5f6d6ec48cab6f.exe 81 PID 4572 wrote to memory of 4040 4572 8fb1c183032cfdb44270837d4750c35fa3f5a66f8955b8525f5f6d6ec48cab6f.exe 81 PID 4572 wrote to memory of 4040 4572 8fb1c183032cfdb44270837d4750c35fa3f5a66f8955b8525f5f6d6ec48cab6f.exe 81 PID 4040 wrote to memory of 3700 4040 xrWaIgm8T5Pv2Qv.exe 84 PID 4040 wrote to memory of 3700 4040 xrWaIgm8T5Pv2Qv.exe 84 PID 4040 wrote to memory of 3700 4040 xrWaIgm8T5Pv2Qv.exe 84 PID 3700 wrote to memory of 4912 3700 regsvr32.exe 85 PID 3700 wrote to memory of 4912 3700 regsvr32.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fb1c183032cfdb44270837d4750c35fa3f5a66f8955b8525f5f6d6ec48cab6f.exe"C:\Users\Admin\AppData\Local\Temp\8fb1c183032cfdb44270837d4750c35fa3f5a66f8955b8525f5f6d6ec48cab6f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\7zS9FEE.tmp\xrWaIgm8T5Pv2Qv.exe.\xrWaIgm8T5Pv2Qv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GooSavve\Sie7JZQQLvfsqE.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GooSavve\Sie7JZQQLvfsqE.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:4912
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4728
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4500
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5f2f684081d25e641af868722e06d59da
SHA1c185dc353974a1e52fa7d73c81d0f964773a3b55
SHA25642d62eaff72966559e5f009e14d608aae024ec0f56b053f6d2c4f8f68c6732c8
SHA512e9c1ea49aafc76893e4e264a0df09ac5f79d74518faa6314064de0fc320150e77800ab7cd4785a75058a261415330cc5cc2654a68094b785f5d226f631260e3f
-
Filesize
619KB
MD54f328f4e17a2c81830aac4c8c3d67141
SHA1063c8e33d6a263dd604d072ffd143305f6c3d4a8
SHA256303917029755e7a44a6e7392c5e751e4fbcb66feaa8a5f09142efaf5a91ad2fc
SHA512d387cf9ee95426717be8bac7a6cd422b8ddc2aa925723a9b25a169d9b4a0f5cb5607e2f2b8161cadb0e4333d1fda4ba24ecb838dbb49571d55a6799efce404c0
-
Filesize
702KB
MD51287246338d36f26f77735bd58d74e70
SHA1aabda37cd307e50f2444c73bd656eaf2b78fc291
SHA2564d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1
SHA512ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1
-
Filesize
702KB
MD51287246338d36f26f77735bd58d74e70
SHA1aabda37cd307e50f2444c73bd656eaf2b78fc291
SHA2564d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1
SHA512ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1
-
Filesize
702KB
MD51287246338d36f26f77735bd58d74e70
SHA1aabda37cd307e50f2444c73bd656eaf2b78fc291
SHA2564d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1
SHA512ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1
-
C:\Users\Admin\AppData\Local\Temp\7zS9FEE.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS9FEE.tmp\[email protected]\chrome.manifest
Filesize35B
MD55685cb977e0234682e238be6f729481f
SHA1ec9609775c30beaca688b97eef248af6341eb8e0
SHA2566c9a4e08396d2e2deee27d92a044b223d65a0541176c23069e0390c34896bea5
SHA512fed5f202e1ff38ba31529cea8852c861ef817647c79776f01a08f5cbfbd7b4cbf0df2803abe4bced4cbca8241db530a65cf79a8581cd87c021b178f27ef2c8d3
-
C:\Users\Admin\AppData\Local\Temp\7zS9FEE.tmp\[email protected]\content\bg.js
Filesize9KB
MD565c1a14e926fc6432d8d2e973128f623
SHA18adb232a6a7458f07fdf0e0cf7b813367a3d5c71
SHA256c3db8505f3a1cae7097f2e1cbfdedb5698c4295985d326e27a5650368204de2c
SHA51227223bf76d7e58649cc13656e74936d090e708103161a319ccdc49bc63160f849bacaacb74736e33a4b487f36d2b1acfdd46b4422f4ab1ef502dd733176d075b
-
C:\Users\Admin\AppData\Local\Temp\7zS9FEE.tmp\[email protected]\install.rdf
Filesize592B
MD54edacebed95a1e111dbba17474dc1467
SHA183996a6807092e0a281ff69ee78b84b59b39e888
SHA2564a26202175eb70f348eb4caff3ac7ab4e3f991ad75b87db91621b00cb065db83
SHA5126ede5a8b220114bf97f41376fc3a274ec579e1244e75f49e1286fbd3feb2c522c5496a143440c8a841262c3906f2c611106f7dd19c76b01b2a370d6d53b0d7a0
-
Filesize
619KB
MD54f328f4e17a2c81830aac4c8c3d67141
SHA1063c8e33d6a263dd604d072ffd143305f6c3d4a8
SHA256303917029755e7a44a6e7392c5e751e4fbcb66feaa8a5f09142efaf5a91ad2fc
SHA512d387cf9ee95426717be8bac7a6cd422b8ddc2aa925723a9b25a169d9b4a0f5cb5607e2f2b8161cadb0e4333d1fda4ba24ecb838dbb49571d55a6799efce404c0
-
Filesize
3KB
MD562cb4133d9d3a46f4f1c6c0fb3688619
SHA1feaaef6e2b8c41be2575d0763cc8de3e8c19478e
SHA2563ddcfb4b206fc4856f5bb5c06bcc3761dde53882eea20b5dc5ddf4ee8864bea5
SHA512cb30dc73d52eb502f745fe32b4055b53306f62f0847cae1275d0856608949ea62c30f40d7f252ad450909a4bd425cf0e50012400175cc42a4096cf1451d90123
-
Filesize
702KB
MD51287246338d36f26f77735bd58d74e70
SHA1aabda37cd307e50f2444c73bd656eaf2b78fc291
SHA2564d1d5893df770fc7c94b33c90f87f8cc8b9d7669f4f914df9139ddb22042acc1
SHA512ee4177dbd58c1327ea0334e43499e99cea642d458844b589116d147d72a6f71e063fe5dadbe262a7bca7cf0ba7ec48708e64827b513abc3e46144bcfcc6f46f1
-
Filesize
7KB
MD534af37e3822815def058b948b10b357d
SHA14715dbfcde112712bd1eec549f8f8186ed77edbe
SHA2560acc00da9df63d78e8a438f9db0d4a2b57535bc5883672d541274e84d4b8251d
SHA512fd108a5b92ed9ac9c663ffdd240e6e912ec65b9ebc9a37f656c8d7c50224d68adb7822ab8f9a158e7e05bbb503a2f055fc8a3ef6dc2f3c1677ceddbc5d78e3bf
-
Filesize
145B
MD5c724de9d771b014ae11b8d968b368c2f
SHA1907f877eeb700cebdf3151fc28c64c978edba586
SHA25650c5736f83a3e4d90567f1411f35eac4dfce866ff3238e77a7933579223a989c
SHA512b38e611c63dc2c3d10abc92aa1047a730004ccbca52169860a1588a0c62e62f724d1e00cd7c129ac3406f03cff438a0fb383e354258d59aa8d45e2dd02d4cf90
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
500B
MD5934257febf417c3c69c6f2714e742f7b
SHA149b71edf22d0e4088f366e81557f11c48cd2f09f
SHA25693cad0c0d4d12604e97215ae8d4b9ee351e1b2f3fc287f7c132ed7013bff2066
SHA5127550c9fdedc7488e44af8dd4ec040cfba5ad97452f99041dd727ee7ae52683bacff59b6cd658f4cd32a567ec5f552b652c89d498e0dd6245a5989bed81f84c76
-
Filesize
7KB
MD5f2f684081d25e641af868722e06d59da
SHA1c185dc353974a1e52fa7d73c81d0f964773a3b55
SHA25642d62eaff72966559e5f009e14d608aae024ec0f56b053f6d2c4f8f68c6732c8
SHA512e9c1ea49aafc76893e4e264a0df09ac5f79d74518faa6314064de0fc320150e77800ab7cd4785a75058a261415330cc5cc2654a68094b785f5d226f631260e3f
-
Filesize
623KB
MD5cd6bf363f5af45a16926343310023db4
SHA1e5bcbe9735e5a8d6243af1c2a4593784e8e63aa6
SHA256bfa98e4e677c8bcb7348aed64d51915e3bacb05925d0234e646e2bb7cc3cdd06
SHA5123ccb2c4ea143ac58d4df43751bf1c8781795b2321f3acb5d85a0249e4b43c1bf3f93c41c0c59cc2933b923069340a3f7425e9ddce1d7355e60eec843d9158ced
-
Filesize
623KB
MD5cd6bf363f5af45a16926343310023db4
SHA1e5bcbe9735e5a8d6243af1c2a4593784e8e63aa6
SHA256bfa98e4e677c8bcb7348aed64d51915e3bacb05925d0234e646e2bb7cc3cdd06
SHA5123ccb2c4ea143ac58d4df43751bf1c8781795b2321f3acb5d85a0249e4b43c1bf3f93c41c0c59cc2933b923069340a3f7425e9ddce1d7355e60eec843d9158ced