Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    171s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2022, 06:03

General

  • Target

    fa6181b5ccaa04bb71c748fe96a180886923fc4cb45d74e37a95f39af609f7e5.exe

  • Size

    2.1MB

  • MD5

    dbbe97ab97bb71ea91cf60881881b1f5

  • SHA1

    f0f2a6ddd51daae700db48eb90cc3aab9954389d

  • SHA256

    fa6181b5ccaa04bb71c748fe96a180886923fc4cb45d74e37a95f39af609f7e5

  • SHA512

    4ff8ad1b2389a158df7ed36e6117593abe190002483aab16024dea211e7cbf0c6a250c09c456e162e4351ae723631c1130594d40ce2f157b7a3170e9c0f7662e

  • SSDEEP

    24576:h1OYdaORTwLleYkTVug2PiL0jHM8WK5z6Sh19BUfOD4XRt1otyBNvJvMXzGK5Ih1:h1OsQLARTQ9PimJWtShQnvQsruu

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa6181b5ccaa04bb71c748fe96a180886923fc4cb45d74e37a95f39af609f7e5.exe
    "C:\Users\Admin\AppData\Local\Temp\fa6181b5ccaa04bb71c748fe96a180886923fc4cb45d74e37a95f39af609f7e5.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\RfopgdfQD9ftyAk.exe
      .\RfopgdfQD9ftyAk.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\YoutubeAdBlocke\qyWpbAg4cGWA8X.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:532
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\YoutubeAdBlocke\qyWpbAg4cGWA8X.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:2192

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\YoutubeAdBlocke\qyWpbAg4cGWA8X.dat

    Filesize

    6KB

    MD5

    009f964007e4ca328af37fbe555722c7

    SHA1

    86da91a93be4f7095b7aa162f51544f225ec7a34

    SHA256

    e86562621400ba71ea26d43dee8acd3237e7542aa11f78095519192faade4f63

    SHA512

    119c1b00fdcbd5c214498adf2fa60299562050388a66f521125826ec39a3b9170e65c7b21c073cd5e5f563d2025a3612f7a5903b4839a9accbd5497ec88e129d

  • C:\Program Files (x86)\YoutubeAdBlocke\qyWpbAg4cGWA8X.dll

    Filesize

    611KB

    MD5

    123fde8f1a45be2f971b36a8ae5457ef

    SHA1

    78f77c976bec0b388407f986e7866818512eec97

    SHA256

    12869f73fb78fcbb8876e10772d081890b19fd1e228dd83ca012416cf26e931e

    SHA512

    4ae3708e45e15a49e7ba1d338a9186ed47f41abe57727d57833a33be887043dcb950d02bc52f79ee414df0df56c3e87f213995fa222a6f0e1c659393860231d9

  • C:\Program Files (x86)\YoutubeAdBlocke\qyWpbAg4cGWA8X.x64.dll

    Filesize

    693KB

    MD5

    c59945c3f5074d51077f2d598680aa11

    SHA1

    7d2ab4599f476d9da677283bdfcff5164a30b2e7

    SHA256

    10658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b

    SHA512

    d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61

  • C:\Program Files (x86)\YoutubeAdBlocke\qyWpbAg4cGWA8X.x64.dll

    Filesize

    693KB

    MD5

    c59945c3f5074d51077f2d598680aa11

    SHA1

    7d2ab4599f476d9da677283bdfcff5164a30b2e7

    SHA256

    10658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b

    SHA512

    d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61

  • C:\Program Files (x86)\YoutubeAdBlocke\qyWpbAg4cGWA8X.x64.dll

    Filesize

    693KB

    MD5

    c59945c3f5074d51077f2d598680aa11

    SHA1

    7d2ab4599f476d9da677283bdfcff5164a30b2e7

    SHA256

    10658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b

    SHA512

    d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    2355f52a1f8bde5cf84da4c963e27b33

    SHA1

    228931663f28f27059792bbc0b4bec8262668452

    SHA256

    74ab76fd892fda9a2b953e3c3704dcdb754b930be09c5a97e8116ab3c68000e0

    SHA512

    02ca74dd089210d34ce1fd7893ff3a4eb7b221e7e1b01bfa582b106727e1ed1bc108c9887b7d4a56f8f6181cca1b1ed5e5ed8f4b50a3e67eaaec3d6654d8ff32

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    7d49653e9d9bd7ad43faaeff32e4dac0

    SHA1

    2581ca50f4bfa9f4e9f2a1ee53b9bdbba2e6c72c

    SHA256

    be572a245ee693854d97584a593a5e7486b3930c6b5bce3f3257f6d86eb0c2f6

    SHA512

    5c09e51aee1aac8dc89fb28d8bd60290e9da4a6cacb0c82e62c96501a4e587cbd805b81ac0c6e76ce7d099df331a08fbc90a8d290daccc950d957d2672bf7192

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\[email protected]\install.rdf

    Filesize

    606B

    MD5

    d7ed24dc06845504c21580a11cc97637

    SHA1

    914002e0670378a73d09c0a6bb89b75b6c581497

    SHA256

    2108c9032ef39e4ee24456c145f88269844e371fa09a59ea18d67170d50bf0d6

    SHA512

    8f4a1e8849c8a2187088934d53b9c10a138c9d8867bf6394dfcbd001586e391a6ce0309e6094401fb5a0b262f2f8120e3b4feafa15dfbeaf5e055dd5e367c320

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\RfopgdfQD9ftyAk.dat

    Filesize

    6KB

    MD5

    009f964007e4ca328af37fbe555722c7

    SHA1

    86da91a93be4f7095b7aa162f51544f225ec7a34

    SHA256

    e86562621400ba71ea26d43dee8acd3237e7542aa11f78095519192faade4f63

    SHA512

    119c1b00fdcbd5c214498adf2fa60299562050388a66f521125826ec39a3b9170e65c7b21c073cd5e5f563d2025a3612f7a5903b4839a9accbd5497ec88e129d

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\RfopgdfQD9ftyAk.exe

    Filesize

    634KB

    MD5

    8b3b2e0c8e5f6fdefb32e82daf230175

    SHA1

    4ddeb5ed636661376b8e1ef41e5162387724ed44

    SHA256

    e7be2ab45ff78525377a8da7205bbc29f871c907ddf30879d29aa0c219f65e99

    SHA512

    8aeb49852cb6a1335df799e8e30b34d83303a225c1a7b2e029368246d81463d653109a4454a3f9196fa050c2a5e9ba4dc8372900c55ce989c821c954cb850038

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\RfopgdfQD9ftyAk.exe

    Filesize

    634KB

    MD5

    8b3b2e0c8e5f6fdefb32e82daf230175

    SHA1

    4ddeb5ed636661376b8e1ef41e5162387724ed44

    SHA256

    e7be2ab45ff78525377a8da7205bbc29f871c907ddf30879d29aa0c219f65e99

    SHA512

    8aeb49852cb6a1335df799e8e30b34d83303a225c1a7b2e029368246d81463d653109a4454a3f9196fa050c2a5e9ba4dc8372900c55ce989c821c954cb850038

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\aeejmpmgliecliljiapoglpcnkgiaipj\As3bcl.js

    Filesize

    5KB

    MD5

    282eecee918206a6ccfeefb5ced378ff

    SHA1

    83799aebf23f6df2a15e96f26bdae856ed5d8e53

    SHA256

    d625b183f597f727962847e35b8223d3f664a545b08518992ef4d468a3d3aa64

    SHA512

    0469e2e010480326a39f3be839c17c52dfdebb04a1b401115483f3c79fe1573f988a7801605679daa663dd040cfec1da03effbe3fcbd438c28c630b5c0d7c9e1

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\aeejmpmgliecliljiapoglpcnkgiaipj\background.html

    Filesize

    143B

    MD5

    550a09c240e559593e1558437089517a

    SHA1

    af789d9a9cd3b9a2d9f5911fb858b48a1d2bf088

    SHA256

    09196f381944d57e808aeaca692e6fbe284de54f5d3f52427e5b8f7e676131bc

    SHA512

    68e93d15735e126740789230bbeb7a5a42e5c85b6794f715e52f094b4edeb047dd6d34ffc20f1019284e791d9fd96fe2085ba56c0a84a7c3531f3f94e2b634ff

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\aeejmpmgliecliljiapoglpcnkgiaipj\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\aeejmpmgliecliljiapoglpcnkgiaipj\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\aeejmpmgliecliljiapoglpcnkgiaipj\manifest.json

    Filesize

    507B

    MD5

    d429395a45a9aa09e4ee9054e9196b30

    SHA1

    c5dbab4e27650b07d4d159c305d08a9d578c3a3e

    SHA256

    674fc32cde82ed69cb8595bbea9f70f69097062c39bd6a3a505227a4f4a45344

    SHA512

    4a5bc7c005e573bf0cdb89489d676fb26c5fe116d397a6cd7a1ebb2cae9605b3d1657378e17d354cb102e93c39b32fa8d2963f375af37c871452f3170356101e

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\qyWpbAg4cGWA8X.dll

    Filesize

    611KB

    MD5

    123fde8f1a45be2f971b36a8ae5457ef

    SHA1

    78f77c976bec0b388407f986e7866818512eec97

    SHA256

    12869f73fb78fcbb8876e10772d081890b19fd1e228dd83ca012416cf26e931e

    SHA512

    4ae3708e45e15a49e7ba1d338a9186ed47f41abe57727d57833a33be887043dcb950d02bc52f79ee414df0df56c3e87f213995fa222a6f0e1c659393860231d9

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\qyWpbAg4cGWA8X.tlb

    Filesize

    3KB

    MD5

    d5c4233a6c3de331b459f5f6a35ae3dd

    SHA1

    b5f1bf145f4e0896d7ae500abecbfaca715c18ab

    SHA256

    f3fca93b2a2848af13dcd30cad6305d20319d0a96f622f96753c1aebb91c885c

    SHA512

    4af48daa80dcd76cf45018d7edef74f35c5917457dd598f5a2071bba8875d75280326e41f3f5885d5301a596c22a3833cb062e2f4c97e0d83a01ad2644056e76

  • C:\Users\Admin\AppData\Local\Temp\7zSCB25.tmp\qyWpbAg4cGWA8X.x64.dll

    Filesize

    693KB

    MD5

    c59945c3f5074d51077f2d598680aa11

    SHA1

    7d2ab4599f476d9da677283bdfcff5164a30b2e7

    SHA256

    10658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b

    SHA512

    d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61