Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    208s
  • max time network
    229s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/11/2022, 10:32

General

  • Target

    306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382.exe

  • Size

    2.1MB

  • MD5

    68661f8117c6df32591168cd500a19c6

  • SHA1

    056bc7223c1b556b446f69c7f46016f797113a43

  • SHA256

    306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382

  • SHA512

    502ed3cc9e505ef1783f0ad5c086579ad8d67d2ec4aaf91a2da57e2fff94386fe23792863f6119e5b27e949ca428f0d4c8ae8ade051e3c98dc8e28118497931c

  • SSDEEP

    24576:h1OYdaOpTwLleYkTVug2PiL0jHM8WK5z6Sh19BUfOD4XRt1otyBNvJvMXzGK5Ih6:h1OsQLARTQ9PimJWtShQnvQsru/

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382.exe
    "C:\Users\Admin\AppData\Local\Temp\306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\S2ZgFN2aWRqVgtL.exe
      .\S2ZgFN2aWRqVgtL.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:4476

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.dat

    Filesize

    5KB

    MD5

    cf90a4e47188e5de06c6fc9751c811c4

    SHA1

    94750b6835f464efde541d0e7b97dc806cc9104c

    SHA256

    4224642d7f0745812c3d7838bac58eb6726ebe792743f217a7d34da317bf9fad

    SHA512

    4223754cac05da582d8c503b49ae1eae8e9a349a117039fe2c84bf4cfd14eb61d88b28f4f67d1cb436c557b5b0e77ddb5686ed268a20bcec6903bdf8f5525a10

  • C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.dll

    Filesize

    611KB

    MD5

    123fde8f1a45be2f971b36a8ae5457ef

    SHA1

    78f77c976bec0b388407f986e7866818512eec97

    SHA256

    12869f73fb78fcbb8876e10772d081890b19fd1e228dd83ca012416cf26e931e

    SHA512

    4ae3708e45e15a49e7ba1d338a9186ed47f41abe57727d57833a33be887043dcb950d02bc52f79ee414df0df56c3e87f213995fa222a6f0e1c659393860231d9

  • C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.x64.dll

    Filesize

    693KB

    MD5

    c59945c3f5074d51077f2d598680aa11

    SHA1

    7d2ab4599f476d9da677283bdfcff5164a30b2e7

    SHA256

    10658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b

    SHA512

    d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61

  • C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.x64.dll

    Filesize

    693KB

    MD5

    c59945c3f5074d51077f2d598680aa11

    SHA1

    7d2ab4599f476d9da677283bdfcff5164a30b2e7

    SHA256

    10658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b

    SHA512

    d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61

  • C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.x64.dll

    Filesize

    693KB

    MD5

    c59945c3f5074d51077f2d598680aa11

    SHA1

    7d2ab4599f476d9da677283bdfcff5164a30b2e7

    SHA256

    10658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b

    SHA512

    d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\S2ZgFN2aWRqVgtL.dat

    Filesize

    5KB

    MD5

    cf90a4e47188e5de06c6fc9751c811c4

    SHA1

    94750b6835f464efde541d0e7b97dc806cc9104c

    SHA256

    4224642d7f0745812c3d7838bac58eb6726ebe792743f217a7d34da317bf9fad

    SHA512

    4223754cac05da582d8c503b49ae1eae8e9a349a117039fe2c84bf4cfd14eb61d88b28f4f67d1cb436c557b5b0e77ddb5686ed268a20bcec6903bdf8f5525a10

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\S2ZgFN2aWRqVgtL.exe

    Filesize

    634KB

    MD5

    8b3b2e0c8e5f6fdefb32e82daf230175

    SHA1

    4ddeb5ed636661376b8e1ef41e5162387724ed44

    SHA256

    e7be2ab45ff78525377a8da7205bbc29f871c907ddf30879d29aa0c219f65e99

    SHA512

    8aeb49852cb6a1335df799e8e30b34d83303a225c1a7b2e029368246d81463d653109a4454a3f9196fa050c2a5e9ba4dc8372900c55ce989c821c954cb850038

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\S2ZgFN2aWRqVgtL.exe

    Filesize

    634KB

    MD5

    8b3b2e0c8e5f6fdefb32e82daf230175

    SHA1

    4ddeb5ed636661376b8e1ef41e5162387724ed44

    SHA256

    e7be2ab45ff78525377a8da7205bbc29f871c907ddf30879d29aa0c219f65e99

    SHA512

    8aeb49852cb6a1335df799e8e30b34d83303a225c1a7b2e029368246d81463d653109a4454a3f9196fa050c2a5e9ba4dc8372900c55ce989c821c954cb850038

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\ddO45NloQ7Qmid.dll

    Filesize

    611KB

    MD5

    123fde8f1a45be2f971b36a8ae5457ef

    SHA1

    78f77c976bec0b388407f986e7866818512eec97

    SHA256

    12869f73fb78fcbb8876e10772d081890b19fd1e228dd83ca012416cf26e931e

    SHA512

    4ae3708e45e15a49e7ba1d338a9186ed47f41abe57727d57833a33be887043dcb950d02bc52f79ee414df0df56c3e87f213995fa222a6f0e1c659393860231d9

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\ddO45NloQ7Qmid.tlb

    Filesize

    3KB

    MD5

    d5c4233a6c3de331b459f5f6a35ae3dd

    SHA1

    b5f1bf145f4e0896d7ae500abecbfaca715c18ab

    SHA256

    f3fca93b2a2848af13dcd30cad6305d20319d0a96f622f96753c1aebb91c885c

    SHA512

    4af48daa80dcd76cf45018d7edef74f35c5917457dd598f5a2071bba8875d75280326e41f3f5885d5301a596c22a3833cb062e2f4c97e0d83a01ad2644056e76

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\ddO45NloQ7Qmid.x64.dll

    Filesize

    693KB

    MD5

    c59945c3f5074d51077f2d598680aa11

    SHA1

    7d2ab4599f476d9da677283bdfcff5164a30b2e7

    SHA256

    10658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b

    SHA512

    d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    69bb45caa3a337eb518f59bff031c8ba

    SHA1

    4cc1775f44943bd00d9a674848edf8aeba17a4b4

    SHA256

    837b83f32af6aa7c2cceee8fff12c700f26b420b942399a3f707a118e940a041

    SHA512

    2c7fcb8e69351e909f95969d84754da77f06a8340797e9b03a2ef1312c25977b2ecc40c3178bfa2126529f5599620299ac266c08666698e39b22af45c326a12f

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    6f0ad917622bd8d8e130c9a62b63aad3

    SHA1

    3f966754b8a2735d2bd001850fc2b2a56977873f

    SHA256

    8bf25c6000ff893a22ffa22ef3a5601892f712a6b7981075d87841409d488f82

    SHA512

    a1af3bf7fc7be36cdee19f94774e940f8663db5f1632a5e2e13af511e6153a0f1b1a5e2d36957e60067044954ce4d91bf0f08639fca8aeaf71e52732725bf4d3

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\[email protected]\install.rdf

    Filesize

    591B

    MD5

    1b350723fd3f0fc2cebf700f1ba896b0

    SHA1

    b606194472bae2ae930e4368079c5bc29fa24388

    SHA256

    21452feff4d0ecad1190915d9e27f72e159b959f6360061c04d591046e9e8f28

    SHA512

    4c633ae038b55713d4ba913b265f57ae84d2ce5796d79668e845eeb19b9305d519bc8b77d435ffe3304dc2473b2287228c86678db818c0ff2f8f1987565c4f82

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\kpdgbbkeakblagadpepekmnjhpjnccpg\background.html

    Filesize

    144B

    MD5

    79e010824bb0aed683c6e07029a538c1

    SHA1

    e290d57e8e07c21f4ee1cf59fd512233b901269b

    SHA256

    164c1787a81d6be3f5341b593ceb555ba0f1ef5a6912b2c71090838b53172b8c

    SHA512

    92740aa7335efa74db7a8ba930ae43c672ff19a735d53dff9132c2c462d30b770e48e2371641397e13c717a29c2280b1dd17cac40d9e66cd0f0fdef6c3dd5850

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\kpdgbbkeakblagadpepekmnjhpjnccpg\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\kpdgbbkeakblagadpepekmnjhpjnccpg\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\kpdgbbkeakblagadpepekmnjhpjnccpg\manifest.json

    Filesize

    498B

    MD5

    640199ea4621e34510de919f6a54436f

    SHA1

    dc65dbfad02bd2688030bd56ca1cab85917a9937

    SHA256

    e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

    SHA512

    d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

  • C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\kpdgbbkeakblagadpepekmnjhpjnccpg\n4MeCY4.js

    Filesize

    5KB

    MD5

    eb42f3528bf8e6869fb4900b575cb372

    SHA1

    a4a46ab2bf3bc69fbc4c0d181363c22d614ff32c

    SHA256

    20ab169b0145179c451114964f5beb4ec9869456fc4f759e8446be9850f43166

    SHA512

    3f152f03511fc8fe9fc64d5debac9256041e0098551904987d1e2e80f33b8fd988d58f469b75d684f368f38a7be4b7519f872c0107f8eac600400a091e72ff02