Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    39s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 07:44

General

  • Target

    efabd1f30000ab6ec70de2019c779ace82363e50c64bccd60ae7f4430281e28c.exe

  • Size

    4.2MB

  • MD5

    1db686ff616e8843abde32d4a38f0690

  • SHA1

    8b061ec90bf85a07e23acdd91e02d9596a3c8eeb

  • SHA256

    efabd1f30000ab6ec70de2019c779ace82363e50c64bccd60ae7f4430281e28c

  • SHA512

    6595ec9cb83da1a9946b2074e9c23d898de513dbea1c0e8104404433271f0599eeec56ead205bf8ef56bac59bdbe299db47a6e0ed62c9d134b311d6e36dca8c6

  • SSDEEP

    49152:K+emQZokrJqB3jEZxA0wyuunfwZU5Bcumt9Q+G0ytzqslWaNTylQmEbp7YuwhI4:KzmU0BM1uHl7qNTEDElZwS

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\efabd1f30000ab6ec70de2019c779ace82363e50c64bccd60ae7f4430281e28c.exe
    "C:\Users\Admin\AppData\Local\Temp\efabd1f30000ab6ec70de2019c779ace82363e50c64bccd60ae7f4430281e28c.exe"
    1⤵
    • Loads dropped DLL
    • Drops Chrome extension
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1292
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\GoSave\TF3rcpruBrpdp3.x64.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files (x86)\GoSave\TF3rcpruBrpdp3.x64.dll"
        3⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:588

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GoSave\TF3rcpruBrpdp3.dat

    Filesize

    4KB

    MD5

    db131e67670e729ddb0be5501993073a

    SHA1

    59091b1c10a25eddca4aa8d9f60a30cb3daf3865

    SHA256

    d07324d547a4267773822b765d834cc4d406883d283aaec1500e461c68b27003

    SHA512

    8f1bf751653e4c6920084dfa976fb4d5f78c580fa6c27d023b62d4a1bc25723c99d92b232ca8e17ad6834e74e7f8ec8cdeb6a0555df5d86b9ed773b165cc1fb5

  • C:\Program Files (x86)\GoSave\TF3rcpruBrpdp3.tlb

    Filesize

    3KB

    MD5

    6bdd6ba23e0c129c5b4fa1a141aa21f6

    SHA1

    beef025f5611f84ce53f24e58435f070f92c064f

    SHA256

    14f706e58b4e332e1bc9b6fc6c650097db6e0ea91ac7ad0064aba01832ddd990

    SHA512

    828d9f58efd731252209ea1ed7d092c9e88190b81272fa704c8cb963f5f9d91172610b90e0bce763c0f5207b10d67d0fc4eb31294fd89dde2a260a19d324bc1b

  • C:\Program Files (x86)\GoSave\TF3rcpruBrpdp3.x64.dll

    Filesize

    882KB

    MD5

    0827270a2d7dca4230839de0511d4280

    SHA1

    264ce2775315b06a37cd51d7152df58e29a11b60

    SHA256

    6863740f9ed110fbf10ef18b8732ada23f4db42e998214ed97a09f5fbdd7571b

    SHA512

    d1bf285d6b084920c8d03170cc317939a6a5a3c8b67f71064478fc02feba512a1bffe7f10da424efd6441e61933af777b70c5ace4dce582a0b2bd3a02bdc76c4

  • \Program Files (x86)\GoSave\TF3rcpruBrpdp3.dll

    Filesize

    750KB

    MD5

    a1e5276fa264891a2394cfb992fef753

    SHA1

    3fc9b45acb1feaf1799f70cf93a965221ffe492e

    SHA256

    7d25cce7e647fbee7c157d7cad8b3a12abb66fa3b992adfede9de78687b69838

    SHA512

    ded2b69d13d0f6dd0b7f1fb0b6e8dd0ff1e6705ef5ecae284421826b630de43f0fc7c7783c3246c9fe31dedf07e35e3051366abcc666dec7ff6fe06416c62fcd

  • \Program Files (x86)\GoSave\TF3rcpruBrpdp3.x64.dll

    Filesize

    882KB

    MD5

    0827270a2d7dca4230839de0511d4280

    SHA1

    264ce2775315b06a37cd51d7152df58e29a11b60

    SHA256

    6863740f9ed110fbf10ef18b8732ada23f4db42e998214ed97a09f5fbdd7571b

    SHA512

    d1bf285d6b084920c8d03170cc317939a6a5a3c8b67f71064478fc02feba512a1bffe7f10da424efd6441e61933af777b70c5ace4dce582a0b2bd3a02bdc76c4

  • \Program Files (x86)\GoSave\TF3rcpruBrpdp3.x64.dll

    Filesize

    882KB

    MD5

    0827270a2d7dca4230839de0511d4280

    SHA1

    264ce2775315b06a37cd51d7152df58e29a11b60

    SHA256

    6863740f9ed110fbf10ef18b8732ada23f4db42e998214ed97a09f5fbdd7571b

    SHA512

    d1bf285d6b084920c8d03170cc317939a6a5a3c8b67f71064478fc02feba512a1bffe7f10da424efd6441e61933af777b70c5ace4dce582a0b2bd3a02bdc76c4

  • memory/588-66-0x000007FEFBA21000-0x000007FEFBA23000-memory.dmp

    Filesize

    8KB

  • memory/1292-54-0x00000000759C1000-0x00000000759C3000-memory.dmp

    Filesize

    8KB

  • memory/1292-55-0x00000000029D0000-0x0000000002A9A000-memory.dmp

    Filesize

    808KB