Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 09:11
Static task
static1
Behavioral task
behavioral1
Sample
40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656.exe
Resource
win7-20221111-en
General
-
Target
40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656.exe
-
Size
2.1MB
-
MD5
cad086a1b3df026d9e1d600b9567c869
-
SHA1
690f94bb47e3f6af952256e4f713e53ff88e2741
-
SHA256
40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656
-
SHA512
ce08277741f37cf851b40bf1923e5887d0103f9c2555a38369d4b1797e6188d13c9cb6cc03dae5f1501af1e0148c37601a0f3fdb5afe5e37765ba3df1e35a0be
-
SSDEEP
49152:h1Ospl9RJLu6vcW6hGkaVR7QSiN/tObJmZcqYUuRTP:h1O8rVOhGRkSixtKDF
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4960 ytpxP4hf6EflS0U.exe -
Loads dropped DLL 3 IoCs
pid Process 4960 ytpxP4hf6EflS0U.exe 4540 regsvr32.exe 4936 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpbjcihpjjplfjjbbnehacmmgmmnknfj\2.0\manifest.json ytpxP4hf6EflS0U.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpbjcihpjjplfjjbbnehacmmgmmnknfj\2.0\manifest.json ytpxP4hf6EflS0U.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpbjcihpjjplfjjbbnehacmmgmmnknfj\2.0\manifest.json ytpxP4hf6EflS0U.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpbjcihpjjplfjjbbnehacmmgmmnknfj\2.0\manifest.json ytpxP4hf6EflS0U.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpbjcihpjjplfjjbbnehacmmgmmnknfj\2.0\manifest.json ytpxP4hf6EflS0U.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects ytpxP4hf6EflS0U.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ ytpxP4hf6EflS0U.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} ytpxP4hf6EflS0U.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} ytpxP4hf6EflS0U.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.dat ytpxP4hf6EflS0U.exe File opened for modification C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.dat ytpxP4hf6EflS0U.exe File created C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.x64.dll ytpxP4hf6EflS0U.exe File opened for modification C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.x64.dll ytpxP4hf6EflS0U.exe File created C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.dll ytpxP4hf6EflS0U.exe File opened for modification C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.dll ytpxP4hf6EflS0U.exe File created C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.tlb ytpxP4hf6EflS0U.exe File opened for modification C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.tlb ytpxP4hf6EflS0U.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4960 ytpxP4hf6EflS0U.exe 4960 ytpxP4hf6EflS0U.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5036 wrote to memory of 4960 5036 40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656.exe 81 PID 5036 wrote to memory of 4960 5036 40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656.exe 81 PID 5036 wrote to memory of 4960 5036 40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656.exe 81 PID 4960 wrote to memory of 4540 4960 ytpxP4hf6EflS0U.exe 82 PID 4960 wrote to memory of 4540 4960 ytpxP4hf6EflS0U.exe 82 PID 4960 wrote to memory of 4540 4960 ytpxP4hf6EflS0U.exe 82 PID 4540 wrote to memory of 4936 4540 regsvr32.exe 83 PID 4540 wrote to memory of 4936 4540 regsvr32.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656.exe"C:\Users\Admin\AppData\Local\Temp\40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\ytpxP4hf6EflS0U.exe.\ytpxP4hf6EflS0U.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:4936
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD51335c4263fd47e58757741dc28ae5224
SHA1b158aca631cf43f99c7be6dc60ac93ca916a4f5f
SHA25659215eafffc943811ddfac18031ec2bcc713acd7c00544159d125e84bfa71083
SHA5129f4561422addc3a2f0386b1994e9edc188ba55b54af875adcd861d0b839577788a8da25462ca680bbace42649a6680dff497e1645e92a0855f04e267323d1fec
-
Filesize
621KB
MD5021d6ecac6ffca37cd098212eb99c22e
SHA1e662d4f6bcee66df291ee638349bd75d5468e834
SHA256f9f805536f4f45348b36aa4d60ed1b9869c5fe36acea58c25064dbcdb1a0ee50
SHA5128fd459ead2ab976a17588f1e5e6c39ffab032d98a1903c1f70ae89dc273eca0a49662f582b6da9e394298ed4f11b7abad50bb51229f77ff2c95502672359572f
-
Filesize
699KB
MD5ab6775c5bb7ec35da3edb40a512efc67
SHA162d695981e4e91137a52311eda763ab69aa28739
SHA256329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c
SHA51207497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c
-
Filesize
699KB
MD5ab6775c5bb7ec35da3edb40a512efc67
SHA162d695981e4e91137a52311eda763ab69aa28739
SHA256329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c
SHA51207497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c
-
Filesize
699KB
MD5ab6775c5bb7ec35da3edb40a512efc67
SHA162d695981e4e91137a52311eda763ab69aa28739
SHA256329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c
SHA51207497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c
-
Filesize
5KB
MD5c6ad1aaf8b9c5543ac9abbe78c5ded8d
SHA1892e9ef500568279b80260444b85f156e661c1ae
SHA2568c6c2cd3f7911831236080454884b54ecdf2e0e4b572365a4e0919578279b08d
SHA512255d99faf2939f66988731c86b6a88e08c49d613603c9d5f252c5b871c15726391fea58652b98855ba74829c8d4fe8bddc6b50a5e26ad9c1a3813df32a8acbf6
-
Filesize
142B
MD5bbba100cc3f08f192ad2e7c6a381aa89
SHA151b03f5da1ccf440065738c390bcdeaedfe90bb6
SHA256e7b3ac7b8c4402963f6563dc366c1cf8352f5ade2f6431e4d1112e3b72abca02
SHA512ad965f4411fa5352d96cab03e9657360b53f302f84264a428f738f739cc4c353fbbf36c7bb464a3578daef46d1497af50113415b86e3ce3cf02cbdec5b53d460
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\[email protected]\chrome.manifest
Filesize35B
MD5177529f24a6d950292baa8b9f4135648
SHA1490b10ba2cfe8f2bceddde368ccafa38c60bd7c8
SHA2563707a32a5a5c2f3bda3a80ea7dd49b3b03272b1d670c13309999b1a9215f0283
SHA512ed0ed9662f0d13eb55ba1e044c948765d6017a6daaa22f617f11e49969db8fbcb26a87844e2d96e6907c6ad2f86a0a66acfd8cfc6f8810ee88eacbc6cc17eee0
-
C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\[email protected]\content\bg.js
Filesize7KB
MD59b95009803142ee4d31150cfde426dde
SHA1b64e4f6b3cb71cdeb5d28ffdacd6c76c79d6fafb
SHA2564f1bcba82a6a54dca440df89f1af4e3fdb43c5b3a4ceb5ac1ad9407c05f09b4e
SHA5121953a37a0f0206dd4e5cbc4073a2e053ce8f4f4fda7947909438cb0aac4b58437baba16279cba934fcccb3987bb71587a1f4be7351417a5a83ea20f8d0a087da
-
C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\[email protected]\install.rdf
Filesize598B
MD5aa271b206d4dc67bf732cc60fbd64a07
SHA1288ddb51b9d0f09864c0ecb3dc5253d57bc234d4
SHA2567bff91b5821de9093515205b691caec058d1af94a19387d940c88696cb653b44
SHA5128e26c5b3145465bf18dae2215f3b0edcda1e00faf36fe189c73548829ed3bb0d7f60af7eabac19bdd935e5d8160f240ad70cf84897bacbf1a5c54b50a585323f
-
Filesize
621KB
MD5021d6ecac6ffca37cd098212eb99c22e
SHA1e662d4f6bcee66df291ee638349bd75d5468e834
SHA256f9f805536f4f45348b36aa4d60ed1b9869c5fe36acea58c25064dbcdb1a0ee50
SHA5128fd459ead2ab976a17588f1e5e6c39ffab032d98a1903c1f70ae89dc273eca0a49662f582b6da9e394298ed4f11b7abad50bb51229f77ff2c95502672359572f
-
Filesize
3KB
MD538dcedc06ce882652b73038799f369c1
SHA109985c74e62920963791808be0765222d2a517d3
SHA25637996a9f383f824002a73026332578b823bacad0a736f2f4c25401f6e2da307c
SHA51278b7ab8fc102a0f874d24bb40e7b399befe3eb8788c08b059487770dd83a390daf0011c34d6cd29dd78e3436bfd6587fff2f50bde0c3bed49e6ffe27ef0b4c16
-
Filesize
699KB
MD5ab6775c5bb7ec35da3edb40a512efc67
SHA162d695981e4e91137a52311eda763ab69aa28739
SHA256329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c
SHA51207497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c
-
Filesize
6KB
MD51335c4263fd47e58757741dc28ae5224
SHA1b158aca631cf43f99c7be6dc60ac93ca916a4f5f
SHA25659215eafffc943811ddfac18031ec2bcc713acd7c00544159d125e84bfa71083
SHA5129f4561422addc3a2f0386b1994e9edc188ba55b54af875adcd861d0b839577788a8da25462ca680bbace42649a6680dff497e1645e92a0855f04e267323d1fec
-
Filesize
622KB
MD580fb7c6cb182b769448bd45c28fcc963
SHA1454ad8e9ee2267c72222e7f8a902b2c19cfab01d
SHA2569abc0a4bba0b42851bed08efb7c1643105b9f256e8ac53ae21d8d7269f9948b3
SHA512224e8954fcb850ab2570005aa9ba82e643a65e0efaba70ac29b045ec9aba9d11414a211c7e87a8ba96eba1bd872d7541bc0d32890a87b20c814d573cfcfb0f14
-
Filesize
622KB
MD580fb7c6cb182b769448bd45c28fcc963
SHA1454ad8e9ee2267c72222e7f8a902b2c19cfab01d
SHA2569abc0a4bba0b42851bed08efb7c1643105b9f256e8ac53ae21d8d7269f9948b3
SHA512224e8954fcb850ab2570005aa9ba82e643a65e0efaba70ac29b045ec9aba9d11414a211c7e87a8ba96eba1bd872d7541bc0d32890a87b20c814d573cfcfb0f14