Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 05:45

General

  • Target

    bfa08678f7b27a1b578c3557bf98ccedcd8eb86493ad1151fd86069b8d5ba53d.exe

  • Size

    2.5MB

  • MD5

    b3d39a0eedc3e121376e695d92435d6b

  • SHA1

    72faa91ddbf2b342bce1d96d846ccb0e7e39f067

  • SHA256

    bfa08678f7b27a1b578c3557bf98ccedcd8eb86493ad1151fd86069b8d5ba53d

  • SHA512

    890654f958b150b6352b8a4f1db9b8a7ded1d8ec5edb12c47acb9ec99e3a6a3c8007800aeab46ad3e63e799f43c25f039cc3a622e4d5f932eda354b3036f6533

  • SSDEEP

    49152:h1Os6MWyUQ+GUVFIcHPvpfvHfZIHpGq7E75HVHw0lkiM1NbT:h1OHMvWHHR6HNh0+X

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bfa08678f7b27a1b578c3557bf98ccedcd8eb86493ad1151fd86069b8d5ba53d.exe
    "C:\Users\Admin\AppData\Local\Temp\bfa08678f7b27a1b578c3557bf98ccedcd8eb86493ad1151fd86069b8d5ba53d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\FXJM8IQLH4J7bty.exe
      .\FXJM8IQLH4J7bty.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\GoSave\phFf95M8aXDSW1.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\GoSave\phFf95M8aXDSW1.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:1080

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GoSave\phFf95M8aXDSW1.dat

    Filesize

    7KB

    MD5

    959110ab2ab6f8d26d1e26142a1f612f

    SHA1

    ceea9c13e81b073156f756661605ec1bc0da2a74

    SHA256

    90c1e49198e939d5a3656c2dec7465c4c635df0646b49a5027fd5460330c82d6

    SHA512

    faa1fe5002f37c2c7a5d35419ba4ee8723bd313678a1adc52665a366e58da55d99c91cfcbc715337e8f06fbaff4411e7bb937a6c948b4d2210815c7e628f558d

  • C:\Program Files (x86)\GoSave\phFf95M8aXDSW1.x64.dll

    Filesize

    882KB

    MD5

    0827270a2d7dca4230839de0511d4280

    SHA1

    264ce2775315b06a37cd51d7152df58e29a11b60

    SHA256

    6863740f9ed110fbf10ef18b8732ada23f4db42e998214ed97a09f5fbdd7571b

    SHA512

    d1bf285d6b084920c8d03170cc317939a6a5a3c8b67f71064478fc02feba512a1bffe7f10da424efd6441e61933af777b70c5ace4dce582a0b2bd3a02bdc76c4

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\FXJM8IQLH4J7bty.dat

    Filesize

    7KB

    MD5

    959110ab2ab6f8d26d1e26142a1f612f

    SHA1

    ceea9c13e81b073156f756661605ec1bc0da2a74

    SHA256

    90c1e49198e939d5a3656c2dec7465c4c635df0646b49a5027fd5460330c82d6

    SHA512

    faa1fe5002f37c2c7a5d35419ba4ee8723bd313678a1adc52665a366e58da55d99c91cfcbc715337e8f06fbaff4411e7bb937a6c948b4d2210815c7e628f558d

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\FXJM8IQLH4J7bty.exe

    Filesize

    771KB

    MD5

    e8ef8ed232808bfa240b33b376bb74a8

    SHA1

    b7ebfbda42fb24594210d3f97921c5b33b88585d

    SHA256

    a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

    SHA512

    24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\FXJM8IQLH4J7bty.exe

    Filesize

    771KB

    MD5

    e8ef8ed232808bfa240b33b376bb74a8

    SHA1

    b7ebfbda42fb24594210d3f97921c5b33b88585d

    SHA256

    a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

    SHA512

    24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    4cf32c0884f1e68d8ae218416bc2b8ee

    SHA1

    0e843c20bc980ed06711716cf62ba7ee2a09765f

    SHA256

    f2900373a31ea7affc9becc972862e94108cc579cd83c9a33fbc705a992d7bde

    SHA512

    0e11d9ecc293ccf302edd2caec9cc223ab5c136c01d008c34fcf9f0c6be4e7615a5148dec1c57c5b96d59b71c790cef1c5545f21916c75133ac0e20de4121e5c

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\[email protected]\content\bg.js

    Filesize

    9KB

    MD5

    805b7e0efc75e094387dc1ffb1437bd7

    SHA1

    a2a9d5c1c02ee91a7b421076d1a572cadeffb8d9

    SHA256

    beb23d08307f35cdb31884312112da2baa33a9946e22a37fb22bb83841cf328f

    SHA512

    cdcd8cd04860b806c74ae36af2ab3e3d9beea8347eafc59513142637b5e96c17b7d86fe27a46cf762bed7a6590170b22242aac98ff724854ea6515898d8e6678

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\[email protected]\install.rdf

    Filesize

    591B

    MD5

    84c8369bc6051d01bd2f2e9ca0626c07

    SHA1

    563de2dcbbe9adc0ced739c5ab58fc448e7ca4c4

    SHA256

    c2167f2976df6f00cee51d2c1189887ef912af340d1548446b210ca983d7931a

    SHA512

    8f55ac85147eb16802ce3395415954b48a663bb29c251eac6389036f54dd732eacb0b454f39a72cb5c9e711cc00c4c387296a25aa31be37b18b17a14616a85ca

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\kmhifaiipghhoiipacbmnhhpidmphbpd\Ky4.js

    Filesize

    6KB

    MD5

    fa0355d57c488d320271cadba375e9ad

    SHA1

    f18d05849e3d8e727b798aea7992b7fc0b7283b8

    SHA256

    db41c2f557d01991a45ccf995b3b0a7aeb86828bd1ddbb8adf5124945bd725c3

    SHA512

    69824455951ac0be8fcaf62f0984166853388068e8b9b54a11a7e50fe778d240a1b21bd422ff9bb013a90d4053b861bcd0d0f5f44149a49019d2b2368b792c3e

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\kmhifaiipghhoiipacbmnhhpidmphbpd\background.html

    Filesize

    140B

    MD5

    1536261135827c2421107bc0ce295494

    SHA1

    ced15cac9c30134f4dce6c9d9d00589a0bd08881

    SHA256

    0c3a23c333eed76aba66b695792799d5618cd58dcf4568d1ae1970d9dae4eb2f

    SHA512

    a247043dbba1be402dba503bce71552753cb4c285d41dca613ca5b45e69980def8ed90bca8f15599dc1dca8928d8abd1646f17d9517416f4f156eae58408238a

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\kmhifaiipghhoiipacbmnhhpidmphbpd\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\kmhifaiipghhoiipacbmnhhpidmphbpd\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\kmhifaiipghhoiipacbmnhhpidmphbpd\manifest.json

    Filesize

    498B

    MD5

    640199ea4621e34510de919f6a54436f

    SHA1

    dc65dbfad02bd2688030bd56ca1cab85917a9937

    SHA256

    e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

    SHA512

    d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\phFf95M8aXDSW1.dll

    Filesize

    750KB

    MD5

    a1e5276fa264891a2394cfb992fef753

    SHA1

    3fc9b45acb1feaf1799f70cf93a965221ffe492e

    SHA256

    7d25cce7e647fbee7c157d7cad8b3a12abb66fa3b992adfede9de78687b69838

    SHA512

    ded2b69d13d0f6dd0b7f1fb0b6e8dd0ff1e6705ef5ecae284421826b630de43f0fc7c7783c3246c9fe31dedf07e35e3051366abcc666dec7ff6fe06416c62fcd

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\phFf95M8aXDSW1.tlb

    Filesize

    3KB

    MD5

    6bdd6ba23e0c129c5b4fa1a141aa21f6

    SHA1

    beef025f5611f84ce53f24e58435f070f92c064f

    SHA256

    14f706e58b4e332e1bc9b6fc6c650097db6e0ea91ac7ad0064aba01832ddd990

    SHA512

    828d9f58efd731252209ea1ed7d092c9e88190b81272fa704c8cb963f5f9d91172610b90e0bce763c0f5207b10d67d0fc4eb31294fd89dde2a260a19d324bc1b

  • C:\Users\Admin\AppData\Local\Temp\7zS235A.tmp\phFf95M8aXDSW1.x64.dll

    Filesize

    882KB

    MD5

    0827270a2d7dca4230839de0511d4280

    SHA1

    264ce2775315b06a37cd51d7152df58e29a11b60

    SHA256

    6863740f9ed110fbf10ef18b8732ada23f4db42e998214ed97a09f5fbdd7571b

    SHA512

    d1bf285d6b084920c8d03170cc317939a6a5a3c8b67f71064478fc02feba512a1bffe7f10da424efd6441e61933af777b70c5ace4dce582a0b2bd3a02bdc76c4

  • \Program Files (x86)\GoSave\phFf95M8aXDSW1.dll

    Filesize

    750KB

    MD5

    a1e5276fa264891a2394cfb992fef753

    SHA1

    3fc9b45acb1feaf1799f70cf93a965221ffe492e

    SHA256

    7d25cce7e647fbee7c157d7cad8b3a12abb66fa3b992adfede9de78687b69838

    SHA512

    ded2b69d13d0f6dd0b7f1fb0b6e8dd0ff1e6705ef5ecae284421826b630de43f0fc7c7783c3246c9fe31dedf07e35e3051366abcc666dec7ff6fe06416c62fcd

  • \Program Files (x86)\GoSave\phFf95M8aXDSW1.x64.dll

    Filesize

    882KB

    MD5

    0827270a2d7dca4230839de0511d4280

    SHA1

    264ce2775315b06a37cd51d7152df58e29a11b60

    SHA256

    6863740f9ed110fbf10ef18b8732ada23f4db42e998214ed97a09f5fbdd7571b

    SHA512

    d1bf285d6b084920c8d03170cc317939a6a5a3c8b67f71064478fc02feba512a1bffe7f10da424efd6441e61933af777b70c5ace4dce582a0b2bd3a02bdc76c4

  • \Program Files (x86)\GoSave\phFf95M8aXDSW1.x64.dll

    Filesize

    882KB

    MD5

    0827270a2d7dca4230839de0511d4280

    SHA1

    264ce2775315b06a37cd51d7152df58e29a11b60

    SHA256

    6863740f9ed110fbf10ef18b8732ada23f4db42e998214ed97a09f5fbdd7571b

    SHA512

    d1bf285d6b084920c8d03170cc317939a6a5a3c8b67f71064478fc02feba512a1bffe7f10da424efd6441e61933af777b70c5ace4dce582a0b2bd3a02bdc76c4

  • \Users\Admin\AppData\Local\Temp\7zS235A.tmp\FXJM8IQLH4J7bty.exe

    Filesize

    771KB

    MD5

    e8ef8ed232808bfa240b33b376bb74a8

    SHA1

    b7ebfbda42fb24594210d3f97921c5b33b88585d

    SHA256

    a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9

    SHA512

    24a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8

  • memory/1080-78-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

    Filesize

    8KB

  • memory/1720-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

    Filesize

    8KB