Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 05:46
Static task
static1
Behavioral task
behavioral1
Sample
b5ea8c3484fbe15dd92222aa7b9227aea85595438c1961b4153319662c813902.exe
Resource
win7-20220812-en
General
-
Target
b5ea8c3484fbe15dd92222aa7b9227aea85595438c1961b4153319662c813902.exe
-
Size
924KB
-
MD5
d2787fc117f2fd1f3ad8146d4bb5742f
-
SHA1
b9082093b04a24afd07bcbbe51693eaa4ee2abce
-
SHA256
b5ea8c3484fbe15dd92222aa7b9227aea85595438c1961b4153319662c813902
-
SHA512
caa0ecaff516faaf8c6ba700b8603d159d9515ca00c8c35e0a4fdb0644f48e5b1d75a362ad63d2f6143d3cb1809ff1c52a8a5da51f603642dab4b04c9341a4c1
-
SSDEEP
24576:h1OYdaOofC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuX0:h1OsVMN6wdBh5N5Z4E8PuX0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2276 ES4aGn2ntvmkRYd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
description ioc Process File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\iionapdpmeckiocbklbnfghbalndghpk\2.0\manifest.json ES4aGn2ntvmkRYd.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\iionapdpmeckiocbklbnfghbalndghpk\2.0\manifest.json ES4aGn2ntvmkRYd.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\iionapdpmeckiocbklbnfghbalndghpk\2.0\manifest.json ES4aGn2ntvmkRYd.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iionapdpmeckiocbklbnfghbalndghpk\2.0\manifest.json ES4aGn2ntvmkRYd.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\iionapdpmeckiocbklbnfghbalndghpk\2.0\manifest.json ES4aGn2ntvmkRYd.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy ES4aGn2ntvmkRYd.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini ES4aGn2ntvmkRYd.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol ES4aGn2ntvmkRYd.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI ES4aGn2ntvmkRYd.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe 2276 ES4aGn2ntvmkRYd.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2276 ES4aGn2ntvmkRYd.exe Token: SeDebugPrivilege 2276 ES4aGn2ntvmkRYd.exe Token: SeDebugPrivilege 2276 ES4aGn2ntvmkRYd.exe Token: SeDebugPrivilege 2276 ES4aGn2ntvmkRYd.exe Token: SeDebugPrivilege 2276 ES4aGn2ntvmkRYd.exe Token: SeDebugPrivilege 2276 ES4aGn2ntvmkRYd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1376 wrote to memory of 2276 1376 b5ea8c3484fbe15dd92222aa7b9227aea85595438c1961b4153319662c813902.exe 81 PID 1376 wrote to memory of 2276 1376 b5ea8c3484fbe15dd92222aa7b9227aea85595438c1961b4153319662c813902.exe 81 PID 1376 wrote to memory of 2276 1376 b5ea8c3484fbe15dd92222aa7b9227aea85595438c1961b4153319662c813902.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5ea8c3484fbe15dd92222aa7b9227aea85595438c1961b4153319662c813902.exe"C:\Users\Admin\AppData\Local\Temp\b5ea8c3484fbe15dd92222aa7b9227aea85595438c1961b4153319662c813902.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\7zSBA2D.tmp\ES4aGn2ntvmkRYd.exe.\ES4aGn2ntvmkRYd.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:1320
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:3356
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSBA2D.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSBA2D.tmp\[email protected]\chrome.manifest
Filesize35B
MD55dd934cf90213af4da0e3a23261fc887
SHA17f239e2bc62ca380fc7d5b637586177029de1601
SHA256b4605bc59b8b4bff107a49d2688fb6a2dadc9b73dcc999120fb5eac0151c62a9
SHA512e88e26dea41f86b0fab08f1ac0565d2f1bf137b185125f9495296e60033d2e8c6250a9b761b5e917e8fca4c28bb9e53da856a78989c142147805e466d4d3ae14
-
C:\Users\Admin\AppData\Local\Temp\7zSBA2D.tmp\[email protected]\content\bg.js
Filesize8KB
MD5b0ed78cbd8016fa3cd70b4693c5441ec
SHA12d17300926ff0344b075993877dfc5b6d616cde8
SHA2566c4e1ea02a0777829cc1dbdc39e1d72dd4d351a95d1a31db751bfdca780404df
SHA512cb2984686306c2fde667d3c647c53a16cd85f815e9fa7112abeeed5557e120aa5b475b9e4c3670ef446cf45545e13be653930ac7a3bb093ae0ec1b25b15acf24
-
C:\Users\Admin\AppData\Local\Temp\7zSBA2D.tmp\[email protected]\install.rdf
Filesize593B
MD5210eea1b919a8d2afbc9c448d41bded7
SHA10fd6bba3bda8fb65efa44d02749f5d2b5395c919
SHA2564b33102b0096e72d21b4d2cca07d768b87c7db31dde8dca0cc896548dd3c34a8
SHA512c43fdc1a06771e747c1ef7e667703427aa704d57232c8edd2446d4471b8f1e1b0dc399ddaa073bdbe59afc3b3ea2be0fd10eeaad159c585913f9b50c022c3e82
-
Filesize
1KB
MD541cfe71455807659b8464190360c9118
SHA1592ee01e9163d7e19e98859eb32abd3bca9c1b17
SHA2560ee4d0fa5987979d38d0b591e1da7b2b0826da0c2e0a159091970e7a44eb34ea
SHA5123e9b0cfeec12578ab8b5d738d0a3b68d7f3fa00cd886a27285f6c36c3516abc77695979db488085e89e5b71b314aceea0c7de3ea5dc7c520ffce3ed95b943b25
-
Filesize
765KB
MD521c7e6ab35acdb8d15ac0590900c5206
SHA1bd696ab0d1806c5492b4444d96fe272f217f4058
SHA256314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec
SHA512775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd
-
Filesize
765KB
MD521c7e6ab35acdb8d15ac0590900c5206
SHA1bd696ab0d1806c5492b4444d96fe272f217f4058
SHA256314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec
SHA512775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd
-
Filesize
6KB
MD57876f4b23ffc8a65aaf66b13593d42b7
SHA1489e4ddf6a8efb2787f846b2bb3f51edd139c91b
SHA2566e019a7ebaf625956d2171afcd3b58d9a13a60ea3ae51e3ada6579b406368496
SHA51262bd19c7306c1ca2ee11f8539d4bab3aa3da153886b87ae3b6d3da3170bdafe542f1d38479face0d8c20c663940a3c7a8caeb0afd6ed51e42f3a5ce8ec08a205
-
Filesize
142B
MD5893ff32b001dc94be994ccdcbfdfc47e
SHA1a969cba3d9b2ef3436cf12743e845a66d8966204
SHA256539002f559e795b5b1c0715e3e421d6405b6c42155448cb4dd179e8eaecd82ca
SHA512307bae6f79268d90f1d84827509b054b356bd880687fce5e09a7e46ba83d50e383882b552301307ec8e362f93c7ab839f0fd5a72ebba23378e2ba7bd1cbcbd25
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a