Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
23s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe
Resource
win7-20220812-en
General
-
Target
68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe
-
Size
924KB
-
MD5
c9ac571ce0221dfd503d8cf6cbcf89d5
-
SHA1
adcd2e32d13bbd4d2a11de03f0d4c3bb317ab0e7
-
SHA256
68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3
-
SHA512
5ee849eaa738b53b12d15cea8dc8d3dc4be6c44ef5445f0995fad5ce0bc3fa3ab3b51b3bf4c26470b23525f088817c798a00c38534005b95e72d3ae31c1b7f2f
-
SSDEEP
24576:h1OYdaOffC5S9N6w6EVX1Lh+mN5Z4E8IlIyYuXc:h1OsSMN6wdBh5N5Z4E8PuXc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 900 aTHqwgbsywEloEM.exe -
Loads dropped DLL 1 IoCs
pid Process 1800 68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhbnpocbjicmppjeejafgpildnemmoa\2.0\manifest.json aTHqwgbsywEloEM.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhbnpocbjicmppjeejafgpildnemmoa\2.0\manifest.json aTHqwgbsywEloEM.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\obhbnpocbjicmppjeejafgpildnemmoa\2.0\manifest.json aTHqwgbsywEloEM.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol aTHqwgbsywEloEM.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI aTHqwgbsywEloEM.exe File opened for modification C:\Windows\System32\GroupPolicy aTHqwgbsywEloEM.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini aTHqwgbsywEloEM.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 900 aTHqwgbsywEloEM.exe 900 aTHqwgbsywEloEM.exe 900 aTHqwgbsywEloEM.exe 900 aTHqwgbsywEloEM.exe 900 aTHqwgbsywEloEM.exe 900 aTHqwgbsywEloEM.exe 900 aTHqwgbsywEloEM.exe 900 aTHqwgbsywEloEM.exe 900 aTHqwgbsywEloEM.exe 900 aTHqwgbsywEloEM.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 900 aTHqwgbsywEloEM.exe Token: SeDebugPrivilege 900 aTHqwgbsywEloEM.exe Token: SeDebugPrivilege 900 aTHqwgbsywEloEM.exe Token: SeDebugPrivilege 900 aTHqwgbsywEloEM.exe Token: SeDebugPrivilege 900 aTHqwgbsywEloEM.exe Token: SeDebugPrivilege 900 aTHqwgbsywEloEM.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1800 wrote to memory of 900 1800 68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe 28 PID 1800 wrote to memory of 900 1800 68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe 28 PID 1800 wrote to memory of 900 1800 68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe 28 PID 1800 wrote to memory of 900 1800 68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe"C:\Users\Admin\AppData\Local\Temp\68ee10fac62102b69aa015f336d259539f3590078facf6a23d71c811e65771f3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\7zS4931.tmp\aTHqwgbsywEloEM.exe.\aTHqwgbsywEloEM.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS4931.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS4931.tmp\[email protected]\chrome.manifest
Filesize35B
MD56d446e171167dd5547d6640dd6ac7927
SHA11d09cb12ddb35648ddcdddcbadca750b987373fe
SHA25654378ae4dff19035a8e821247e477fff17408035f5ea719c5a9a124e33f65abb
SHA5129e68edac177ae61e95820595d696b1abb8a9fa2981bf541a0ce6a572382610a7214ed76c58c945f6d0a6d2457fd6ee62357c68dc55d8ad5dc1b50053489134e7
-
C:\Users\Admin\AppData\Local\Temp\7zS4931.tmp\[email protected]\content\bg.js
Filesize8KB
MD58bc49420068350baa64fd0cae887c99e
SHA12aaf9333f2df865985d0a290ebbaa98ab6d31f5c
SHA25679cc94878980e38a1767d4b05895afd1f068ffbc5f2ee8762b260dac1400405c
SHA512505711403b36e99cf65470893d5d46a77e0b781f493173d085a6a44b5349c3e2421a90e03bad7f0cdaa70f2e673d6fc62e7e0d67e1e80856c3c46db272167124
-
C:\Users\Admin\AppData\Local\Temp\7zS4931.tmp\[email protected]\install.rdf
Filesize594B
MD5453e9e5975f3c67b4b14f05ea101a20e
SHA1aeaa30e1ef4ff36fd5c209510ae4e4f1894600bc
SHA256893d4b9bbfa8f8d526099097ec4bb557590b4230a58303d01ab5c7f0a32b2564
SHA512bac11246d2181662c3512289a350f68fa5d0055f7ed011f5adc7e9165bcd014b3c56154025a0e30a3460b2b1072c167d3b13338a5a8148a03475d7c5a8524c61
-
Filesize
1KB
MD5288d9d2aecacf7d77cf2427c3ff15760
SHA1598b17c5c200237f2129c34a904e408f9234b38b
SHA2568c93ffe158f2c513a70a50900dea74b0ae99765d168ecace259fe5ce56d739bf
SHA5128ab4df36faf294c33e9eb0002d9386edcaf913554325b3b023fe38e51bef801e963317ff01a0969848dc450a7c5bd140fb9ba4c8cf7200dfd41379e87f8849ca
-
Filesize
765KB
MD521c7e6ab35acdb8d15ac0590900c5206
SHA1bd696ab0d1806c5492b4444d96fe272f217f4058
SHA256314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec
SHA512775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd
-
Filesize
6KB
MD56157fe6d35ac071d8648f923f3185e32
SHA19184d39bfd656efaedafdfa2c5e096467b3ee1c4
SHA256f251455be0533b609cb038e1183cf39aa44347c6fc8d978a7b6a82267459abc5
SHA512b96fde7e392c5023593c19bfc1d71b9a6ceda60665e5c112c3726dd276ecb130768fba0b5bb539b3d5f252082bb78894842218506e18b23747f40b2f625788d6
-
Filesize
145B
MD55b0f872151e7f50d6ec1e65c934f05d3
SHA1911b64c9823f3591861771c2bcdbcb302414bd75
SHA25634f6a1c485dff37f789214382a3cf6970f2f63d678c4a0621f720904733450e7
SHA512cbb60062eebf37632fdb3dc2a7d0b634e14ec8018fc908f56be593cd6e7f470badb591173f11f54a0d8dc2dbc12c26fb539e844ea83271e3cc80aa4b217d2cc9
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
Filesize
765KB
MD521c7e6ab35acdb8d15ac0590900c5206
SHA1bd696ab0d1806c5492b4444d96fe272f217f4058
SHA256314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec
SHA512775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd