Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2022, 09:11

General

  • Target

    40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656.exe

  • Size

    2.1MB

  • MD5

    cad086a1b3df026d9e1d600b9567c869

  • SHA1

    690f94bb47e3f6af952256e4f713e53ff88e2741

  • SHA256

    40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656

  • SHA512

    ce08277741f37cf851b40bf1923e5887d0103f9c2555a38369d4b1797e6188d13c9cb6cc03dae5f1501af1e0148c37601a0f3fdb5afe5e37765ba3df1e35a0be

  • SSDEEP

    49152:h1Ospl9RJLu6vcW6hGkaVR7QSiN/tObJmZcqYUuRTP:h1O8rVOhGRkSixtKDF

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656.exe
    "C:\Users\Admin\AppData\Local\Temp\40713ff2bac5fce5dcf8a5b47b5528225f3aad269e1f283f6b5787b8fead2656.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\ytpxP4hf6EflS0U.exe
      .\ytpxP4hf6EflS0U.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4960
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:4936

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.dat

    Filesize

    6KB

    MD5

    1335c4263fd47e58757741dc28ae5224

    SHA1

    b158aca631cf43f99c7be6dc60ac93ca916a4f5f

    SHA256

    59215eafffc943811ddfac18031ec2bcc713acd7c00544159d125e84bfa71083

    SHA512

    9f4561422addc3a2f0386b1994e9edc188ba55b54af875adcd861d0b839577788a8da25462ca680bbace42649a6680dff497e1645e92a0855f04e267323d1fec

  • C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.dll

    Filesize

    621KB

    MD5

    021d6ecac6ffca37cd098212eb99c22e

    SHA1

    e662d4f6bcee66df291ee638349bd75d5468e834

    SHA256

    f9f805536f4f45348b36aa4d60ed1b9869c5fe36acea58c25064dbcdb1a0ee50

    SHA512

    8fd459ead2ab976a17588f1e5e6c39ffab032d98a1903c1f70ae89dc273eca0a49662f582b6da9e394298ed4f11b7abad50bb51229f77ff2c95502672359572f

  • C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.x64.dll

    Filesize

    699KB

    MD5

    ab6775c5bb7ec35da3edb40a512efc67

    SHA1

    62d695981e4e91137a52311eda763ab69aa28739

    SHA256

    329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c

    SHA512

    07497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c

  • C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.x64.dll

    Filesize

    699KB

    MD5

    ab6775c5bb7ec35da3edb40a512efc67

    SHA1

    62d695981e4e91137a52311eda763ab69aa28739

    SHA256

    329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c

    SHA512

    07497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c

  • C:\Program Files (x86)\GoSave\nNzTHPaqPXylpP.x64.dll

    Filesize

    699KB

    MD5

    ab6775c5bb7ec35da3edb40a512efc67

    SHA1

    62d695981e4e91137a52311eda763ab69aa28739

    SHA256

    329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c

    SHA512

    07497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\gpbjcihpjjplfjjbbnehacmmgmmnknfj\TjNMV.js

    Filesize

    5KB

    MD5

    c6ad1aaf8b9c5543ac9abbe78c5ded8d

    SHA1

    892e9ef500568279b80260444b85f156e661c1ae

    SHA256

    8c6c2cd3f7911831236080454884b54ecdf2e0e4b572365a4e0919578279b08d

    SHA512

    255d99faf2939f66988731c86b6a88e08c49d613603c9d5f252c5b871c15726391fea58652b98855ba74829c8d4fe8bddc6b50a5e26ad9c1a3813df32a8acbf6

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\gpbjcihpjjplfjjbbnehacmmgmmnknfj\background.html

    Filesize

    142B

    MD5

    bbba100cc3f08f192ad2e7c6a381aa89

    SHA1

    51b03f5da1ccf440065738c390bcdeaedfe90bb6

    SHA256

    e7b3ac7b8c4402963f6563dc366c1cf8352f5ade2f6431e4d1112e3b72abca02

    SHA512

    ad965f4411fa5352d96cab03e9657360b53f302f84264a428f738f739cc4c353fbbf36c7bb464a3578daef46d1497af50113415b86e3ce3cf02cbdec5b53d460

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\gpbjcihpjjplfjjbbnehacmmgmmnknfj\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\gpbjcihpjjplfjjbbnehacmmgmmnknfj\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\gpbjcihpjjplfjjbbnehacmmgmmnknfj\manifest.json

    Filesize

    498B

    MD5

    640199ea4621e34510de919f6a54436f

    SHA1

    dc65dbfad02bd2688030bd56ca1cab85917a9937

    SHA256

    e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

    SHA512

    d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    177529f24a6d950292baa8b9f4135648

    SHA1

    490b10ba2cfe8f2bceddde368ccafa38c60bd7c8

    SHA256

    3707a32a5a5c2f3bda3a80ea7dd49b3b03272b1d670c13309999b1a9215f0283

    SHA512

    ed0ed9662f0d13eb55ba1e044c948765d6017a6daaa22f617f11e49969db8fbcb26a87844e2d96e6907c6ad2f86a0a66acfd8cfc6f8810ee88eacbc6cc17eee0

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    9b95009803142ee4d31150cfde426dde

    SHA1

    b64e4f6b3cb71cdeb5d28ffdacd6c76c79d6fafb

    SHA256

    4f1bcba82a6a54dca440df89f1af4e3fdb43c5b3a4ceb5ac1ad9407c05f09b4e

    SHA512

    1953a37a0f0206dd4e5cbc4073a2e053ce8f4f4fda7947909438cb0aac4b58437baba16279cba934fcccb3987bb71587a1f4be7351417a5a83ea20f8d0a087da

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\[email protected]\install.rdf

    Filesize

    598B

    MD5

    aa271b206d4dc67bf732cc60fbd64a07

    SHA1

    288ddb51b9d0f09864c0ecb3dc5253d57bc234d4

    SHA256

    7bff91b5821de9093515205b691caec058d1af94a19387d940c88696cb653b44

    SHA512

    8e26c5b3145465bf18dae2215f3b0edcda1e00faf36fe189c73548829ed3bb0d7f60af7eabac19bdd935e5d8160f240ad70cf84897bacbf1a5c54b50a585323f

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\nNzTHPaqPXylpP.dll

    Filesize

    621KB

    MD5

    021d6ecac6ffca37cd098212eb99c22e

    SHA1

    e662d4f6bcee66df291ee638349bd75d5468e834

    SHA256

    f9f805536f4f45348b36aa4d60ed1b9869c5fe36acea58c25064dbcdb1a0ee50

    SHA512

    8fd459ead2ab976a17588f1e5e6c39ffab032d98a1903c1f70ae89dc273eca0a49662f582b6da9e394298ed4f11b7abad50bb51229f77ff2c95502672359572f

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\nNzTHPaqPXylpP.tlb

    Filesize

    3KB

    MD5

    38dcedc06ce882652b73038799f369c1

    SHA1

    09985c74e62920963791808be0765222d2a517d3

    SHA256

    37996a9f383f824002a73026332578b823bacad0a736f2f4c25401f6e2da307c

    SHA512

    78b7ab8fc102a0f874d24bb40e7b399befe3eb8788c08b059487770dd83a390daf0011c34d6cd29dd78e3436bfd6587fff2f50bde0c3bed49e6ffe27ef0b4c16

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\nNzTHPaqPXylpP.x64.dll

    Filesize

    699KB

    MD5

    ab6775c5bb7ec35da3edb40a512efc67

    SHA1

    62d695981e4e91137a52311eda763ab69aa28739

    SHA256

    329366453e9690aa8bc34a4d2cec6f90e2b0ddac7608fdfa2a59b950e099f48c

    SHA512

    07497f58eac44f9b626cf02e1d3043bf51779e7e7fe49878cdcf5888c93a1123043e9c5b813a1049922470ec2116d1d60fa66c770162ef778fc182a878b7ce8c

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\ytpxP4hf6EflS0U.dat

    Filesize

    6KB

    MD5

    1335c4263fd47e58757741dc28ae5224

    SHA1

    b158aca631cf43f99c7be6dc60ac93ca916a4f5f

    SHA256

    59215eafffc943811ddfac18031ec2bcc713acd7c00544159d125e84bfa71083

    SHA512

    9f4561422addc3a2f0386b1994e9edc188ba55b54af875adcd861d0b839577788a8da25462ca680bbace42649a6680dff497e1645e92a0855f04e267323d1fec

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\ytpxP4hf6EflS0U.exe

    Filesize

    622KB

    MD5

    80fb7c6cb182b769448bd45c28fcc963

    SHA1

    454ad8e9ee2267c72222e7f8a902b2c19cfab01d

    SHA256

    9abc0a4bba0b42851bed08efb7c1643105b9f256e8ac53ae21d8d7269f9948b3

    SHA512

    224e8954fcb850ab2570005aa9ba82e643a65e0efaba70ac29b045ec9aba9d11414a211c7e87a8ba96eba1bd872d7541bc0d32890a87b20c814d573cfcfb0f14

  • C:\Users\Admin\AppData\Local\Temp\7zSB2BB.tmp\ytpxP4hf6EflS0U.exe

    Filesize

    622KB

    MD5

    80fb7c6cb182b769448bd45c28fcc963

    SHA1

    454ad8e9ee2267c72222e7f8a902b2c19cfab01d

    SHA256

    9abc0a4bba0b42851bed08efb7c1643105b9f256e8ac53ae21d8d7269f9948b3

    SHA512

    224e8954fcb850ab2570005aa9ba82e643a65e0efaba70ac29b045ec9aba9d11414a211c7e87a8ba96eba1bd872d7541bc0d32890a87b20c814d573cfcfb0f14