Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 10:19
Static task
static1
Behavioral task
behavioral1
Sample
69844eb0e8741dd263fb16322ff823ae7334caf078f3dcb1b727bf7659060bc2.exe
Resource
win7-20220812-en
General
-
Target
69844eb0e8741dd263fb16322ff823ae7334caf078f3dcb1b727bf7659060bc2.exe
-
Size
931KB
-
MD5
95338b59d1ca7ae357b992a70e58a053
-
SHA1
0de575eb76c6d021a8c3cf72c37880136b1400ea
-
SHA256
69844eb0e8741dd263fb16322ff823ae7334caf078f3dcb1b727bf7659060bc2
-
SHA512
82804282bd3be09b2f0a6e053a7c876d694a75322646a1985d5a2d281202a8186820f94e233be647ff37f24b6be33d8b8fabf2cce82b2c57f6008baa5c40aa26
-
SSDEEP
24576:h1OYdaOQMWSUbvCXEQKSqGv8VWumF6RmcJozyPvpfe:h1Os6MWyUQ+GUVFIcHPvpfe
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2536 V3rSUgWZNyKIxSg.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
description ioc Process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\aecihllfgpajkelpnggmgkoknoijndlp\2.0\manifest.json V3rSUgWZNyKIxSg.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\aecihllfgpajkelpnggmgkoknoijndlp\2.0\manifest.json V3rSUgWZNyKIxSg.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aecihllfgpajkelpnggmgkoknoijndlp\2.0\manifest.json V3rSUgWZNyKIxSg.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aecihllfgpajkelpnggmgkoknoijndlp\2.0\manifest.json V3rSUgWZNyKIxSg.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\aecihllfgpajkelpnggmgkoknoijndlp\2.0\manifest.json V3rSUgWZNyKIxSg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI V3rSUgWZNyKIxSg.exe File opened for modification C:\Windows\System32\GroupPolicy V3rSUgWZNyKIxSg.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini V3rSUgWZNyKIxSg.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol V3rSUgWZNyKIxSg.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe 2536 V3rSUgWZNyKIxSg.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2536 V3rSUgWZNyKIxSg.exe Token: SeDebugPrivilege 2536 V3rSUgWZNyKIxSg.exe Token: SeDebugPrivilege 2536 V3rSUgWZNyKIxSg.exe Token: SeDebugPrivilege 2536 V3rSUgWZNyKIxSg.exe Token: SeDebugPrivilege 2536 V3rSUgWZNyKIxSg.exe Token: SeDebugPrivilege 2536 V3rSUgWZNyKIxSg.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2536 2556 69844eb0e8741dd263fb16322ff823ae7334caf078f3dcb1b727bf7659060bc2.exe 83 PID 2556 wrote to memory of 2536 2556 69844eb0e8741dd263fb16322ff823ae7334caf078f3dcb1b727bf7659060bc2.exe 83 PID 2556 wrote to memory of 2536 2556 69844eb0e8741dd263fb16322ff823ae7334caf078f3dcb1b727bf7659060bc2.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\69844eb0e8741dd263fb16322ff823ae7334caf078f3dcb1b727bf7659060bc2.exe"C:\Users\Admin\AppData\Local\Temp\69844eb0e8741dd263fb16322ff823ae7334caf078f3dcb1b727bf7659060bc2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\7zSC355.tmp\V3rSUgWZNyKIxSg.exe.\V3rSUgWZNyKIxSg.exe2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:3200
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:5104
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59db2b9991a75661741311870816a240c
SHA1d2474fa9bd41ba23c3f96c7430085e8a79db8fdc
SHA256eb06059b6b1bcebf4ba9dea2748ed19efe9d25f112772250f49cc2e1e97f658f
SHA512f61c4f02396ccfe839c64a66859cc8c3c2dff6c68112004875a7d3cee4782debab4dc96526820d0b76e1a308965a04c5d9f89e32418b76aceedd40fbffd45c77
-
Filesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
Filesize
771KB
MD5e8ef8ed232808bfa240b33b376bb74a8
SHA1b7ebfbda42fb24594210d3f97921c5b33b88585d
SHA256a4265c00fc8eb9371329ddbc19e760b433ea9f4ab4e16d4d95682031940ad6c9
SHA51224a4de7ba07c5712a94cb8334764b6d23799dc4bb7153acf4eb7289ec4577b79bc9bf4adf6e0c65b13441d7783314ec4d9a13a61cf447124c43c44ff55fa8ef8
-
Filesize
145B
MD56b2dfebddb8d6c1b9a1bee88a4aa678c
SHA16831429135afa98f0f82978befc845a9d9017d73
SHA256b461aaca23ea2b229b870e651f72998240da03fb7d5e62e9401f3b721a0a6ba7
SHA512c7ab5fed4fc79f871dadabb805988135d3637467bcff9c4a68df579e13fcdcc87b0dd57d31701ac28d646e0f4375c318a5af251cb41fe75a127873d26584a670
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
Filesize
6KB
MD5ca8041e3723c26f0d88216944500b876
SHA1b4df728c383dfe3a3163cd5f099d5da3a843478c
SHA2560a508c5ffb624b2510389defa6f1027c57baa4d8a9736d347715755c64f5bafd
SHA512a360c2a356b982c273df58b9b8fe780a6efe27aa9f30cdccf4290e53af00baf097099f22182e8098310d441e295cad3d5703a71c154aed93d17e42becfe8e1b0
-
C:\Users\Admin\AppData\Local\Temp\7zSC355.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zSC355.tmp\[email protected]\chrome.manifest
Filesize35B
MD597ed1b9b82491fc69939541cc5462eb3
SHA188a693f6a15cf562e49d0873a77f0bcda23c11c3
SHA256e9d99e3e570a2340416329efe95b00625bb01148d8a0f32fb914bb306afe0fd5
SHA5125afa76907fcc2eba4c34f55aa967dfd71b26e7049b5450ed24ab9e376908790d9afc6ae0bd2be897a9e2e43f9073e805b2b31dd78e66fc4a51fe375bf8c6ac91
-
C:\Users\Admin\AppData\Local\Temp\7zSC355.tmp\[email protected]\content\bg.js
Filesize9KB
MD5c33a3f6710adc64d2d621a3a85920083
SHA1ae124a0d41fb6bcf36d71149cfd985b61f50209a
SHA25672cfaa1b429490fa87ba79dc0c0336db6f8ba137213f571f2cc19748ad1d7baa
SHA5123b73edfd050b164d628cba2801e2f2783ba5dcf6a87b619f63f0c1d35de1b61d6c217c15e7b53f397d08950c0fbfa0f0e0e7c8db7048e76b45549e7492ae0a37
-
C:\Users\Admin\AppData\Local\Temp\7zSC355.tmp\[email protected]\install.rdf
Filesize598B
MD585aa6a7e32dc9bebaf9e3ca40cd3f366
SHA1611aa71539734d3994806c09900eef25d0c7b34d
SHA2569b66d19c8aebc9fdf1008b441db0be3e46767d64ff14d8272c73e51768a4ee89
SHA5127fe6c05cdca860d68498ef4a69c60101140e451d48f17454c7418affd6dd5d185cba5faa8296001bc6013454a468dde9e4f795af99af5f1b1f0186ebc9b41483