Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
208s -
max time network
229s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382.exe
Resource
win7-20220812-en
General
-
Target
306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382.exe
-
Size
2.1MB
-
MD5
68661f8117c6df32591168cd500a19c6
-
SHA1
056bc7223c1b556b446f69c7f46016f797113a43
-
SHA256
306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382
-
SHA512
502ed3cc9e505ef1783f0ad5c086579ad8d67d2ec4aaf91a2da57e2fff94386fe23792863f6119e5b27e949ca428f0d4c8ae8ade051e3c98dc8e28118497931c
-
SSDEEP
24576:h1OYdaOpTwLleYkTVug2PiL0jHM8WK5z6Sh19BUfOD4XRt1otyBNvJvMXzGK5Ih6:h1OsQLARTQ9PimJWtShQnvQsru/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1464 S2ZgFN2aWRqVgtL.exe -
Loads dropped DLL 3 IoCs
pid Process 1464 S2ZgFN2aWRqVgtL.exe 1080 regsvr32.exe 4476 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdgbbkeakblagadpepekmnjhpjnccpg\2.0\manifest.json S2ZgFN2aWRqVgtL.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdgbbkeakblagadpepekmnjhpjnccpg\2.0\manifest.json S2ZgFN2aWRqVgtL.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdgbbkeakblagadpepekmnjhpjnccpg\2.0\manifest.json S2ZgFN2aWRqVgtL.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdgbbkeakblagadpepekmnjhpjnccpg\2.0\manifest.json S2ZgFN2aWRqVgtL.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdgbbkeakblagadpepekmnjhpjnccpg\2.0\manifest.json S2ZgFN2aWRqVgtL.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} S2ZgFN2aWRqVgtL.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects S2ZgFN2aWRqVgtL.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ S2ZgFN2aWRqVgtL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} S2ZgFN2aWRqVgtL.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.x64.dll S2ZgFN2aWRqVgtL.exe File created C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.dll S2ZgFN2aWRqVgtL.exe File opened for modification C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.dll S2ZgFN2aWRqVgtL.exe File created C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.tlb S2ZgFN2aWRqVgtL.exe File opened for modification C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.tlb S2ZgFN2aWRqVgtL.exe File created C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.dat S2ZgFN2aWRqVgtL.exe File opened for modification C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.dat S2ZgFN2aWRqVgtL.exe File created C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.x64.dll S2ZgFN2aWRqVgtL.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1464 S2ZgFN2aWRqVgtL.exe 1464 S2ZgFN2aWRqVgtL.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1464 1484 306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382.exe 79 PID 1484 wrote to memory of 1464 1484 306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382.exe 79 PID 1484 wrote to memory of 1464 1484 306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382.exe 79 PID 1464 wrote to memory of 1080 1464 S2ZgFN2aWRqVgtL.exe 80 PID 1464 wrote to memory of 1080 1464 S2ZgFN2aWRqVgtL.exe 80 PID 1464 wrote to memory of 1080 1464 S2ZgFN2aWRqVgtL.exe 80 PID 1080 wrote to memory of 4476 1080 regsvr32.exe 81 PID 1080 wrote to memory of 4476 1080 regsvr32.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382.exe"C:\Users\Admin\AppData\Local\Temp\306525170e961a2527c35688e640b41e12a1136ac08d4bc8b83d4e82860d4382.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\S2ZgFN2aWRqVgtL.exe.\S2ZgFN2aWRqVgtL.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\ddO45NloQ7Qmid.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:4476
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5cf90a4e47188e5de06c6fc9751c811c4
SHA194750b6835f464efde541d0e7b97dc806cc9104c
SHA2564224642d7f0745812c3d7838bac58eb6726ebe792743f217a7d34da317bf9fad
SHA5124223754cac05da582d8c503b49ae1eae8e9a349a117039fe2c84bf4cfd14eb61d88b28f4f67d1cb436c557b5b0e77ddb5686ed268a20bcec6903bdf8f5525a10
-
Filesize
611KB
MD5123fde8f1a45be2f971b36a8ae5457ef
SHA178f77c976bec0b388407f986e7866818512eec97
SHA25612869f73fb78fcbb8876e10772d081890b19fd1e228dd83ca012416cf26e931e
SHA5124ae3708e45e15a49e7ba1d338a9186ed47f41abe57727d57833a33be887043dcb950d02bc52f79ee414df0df56c3e87f213995fa222a6f0e1c659393860231d9
-
Filesize
693KB
MD5c59945c3f5074d51077f2d598680aa11
SHA17d2ab4599f476d9da677283bdfcff5164a30b2e7
SHA25610658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b
SHA512d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61
-
Filesize
693KB
MD5c59945c3f5074d51077f2d598680aa11
SHA17d2ab4599f476d9da677283bdfcff5164a30b2e7
SHA25610658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b
SHA512d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61
-
Filesize
693KB
MD5c59945c3f5074d51077f2d598680aa11
SHA17d2ab4599f476d9da677283bdfcff5164a30b2e7
SHA25610658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b
SHA512d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61
-
Filesize
5KB
MD5cf90a4e47188e5de06c6fc9751c811c4
SHA194750b6835f464efde541d0e7b97dc806cc9104c
SHA2564224642d7f0745812c3d7838bac58eb6726ebe792743f217a7d34da317bf9fad
SHA5124223754cac05da582d8c503b49ae1eae8e9a349a117039fe2c84bf4cfd14eb61d88b28f4f67d1cb436c557b5b0e77ddb5686ed268a20bcec6903bdf8f5525a10
-
Filesize
634KB
MD58b3b2e0c8e5f6fdefb32e82daf230175
SHA14ddeb5ed636661376b8e1ef41e5162387724ed44
SHA256e7be2ab45ff78525377a8da7205bbc29f871c907ddf30879d29aa0c219f65e99
SHA5128aeb49852cb6a1335df799e8e30b34d83303a225c1a7b2e029368246d81463d653109a4454a3f9196fa050c2a5e9ba4dc8372900c55ce989c821c954cb850038
-
Filesize
634KB
MD58b3b2e0c8e5f6fdefb32e82daf230175
SHA14ddeb5ed636661376b8e1ef41e5162387724ed44
SHA256e7be2ab45ff78525377a8da7205bbc29f871c907ddf30879d29aa0c219f65e99
SHA5128aeb49852cb6a1335df799e8e30b34d83303a225c1a7b2e029368246d81463d653109a4454a3f9196fa050c2a5e9ba4dc8372900c55ce989c821c954cb850038
-
Filesize
611KB
MD5123fde8f1a45be2f971b36a8ae5457ef
SHA178f77c976bec0b388407f986e7866818512eec97
SHA25612869f73fb78fcbb8876e10772d081890b19fd1e228dd83ca012416cf26e931e
SHA5124ae3708e45e15a49e7ba1d338a9186ed47f41abe57727d57833a33be887043dcb950d02bc52f79ee414df0df56c3e87f213995fa222a6f0e1c659393860231d9
-
Filesize
3KB
MD5d5c4233a6c3de331b459f5f6a35ae3dd
SHA1b5f1bf145f4e0896d7ae500abecbfaca715c18ab
SHA256f3fca93b2a2848af13dcd30cad6305d20319d0a96f622f96753c1aebb91c885c
SHA5124af48daa80dcd76cf45018d7edef74f35c5917457dd598f5a2071bba8875d75280326e41f3f5885d5301a596c22a3833cb062e2f4c97e0d83a01ad2644056e76
-
Filesize
693KB
MD5c59945c3f5074d51077f2d598680aa11
SHA17d2ab4599f476d9da677283bdfcff5164a30b2e7
SHA25610658a9b7ad99f84d73c77bde58761c89f37b1318f90197710d63824ae894b5b
SHA512d3ccea87caba7d10776c0d4726b26cad81e85562270a1c873a59ab59a0d73336bae0af6cb6a242fb8f1b4cb4278636ed9995bd03f4f0b32d84a705e19a7b7e61
-
C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\[email protected]\chrome.manifest
Filesize35B
MD569bb45caa3a337eb518f59bff031c8ba
SHA14cc1775f44943bd00d9a674848edf8aeba17a4b4
SHA256837b83f32af6aa7c2cceee8fff12c700f26b420b942399a3f707a118e940a041
SHA5122c7fcb8e69351e909f95969d84754da77f06a8340797e9b03a2ef1312c25977b2ecc40c3178bfa2126529f5599620299ac266c08666698e39b22af45c326a12f
-
C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\[email protected]\content\bg.js
Filesize7KB
MD56f0ad917622bd8d8e130c9a62b63aad3
SHA13f966754b8a2735d2bd001850fc2b2a56977873f
SHA2568bf25c6000ff893a22ffa22ef3a5601892f712a6b7981075d87841409d488f82
SHA512a1af3bf7fc7be36cdee19f94774e940f8663db5f1632a5e2e13af511e6153a0f1b1a5e2d36957e60067044954ce4d91bf0f08639fca8aeaf71e52732725bf4d3
-
C:\Users\Admin\AppData\Local\Temp\7zS9143.tmp\[email protected]\install.rdf
Filesize591B
MD51b350723fd3f0fc2cebf700f1ba896b0
SHA1b606194472bae2ae930e4368079c5bc29fa24388
SHA25621452feff4d0ecad1190915d9e27f72e159b959f6360061c04d591046e9e8f28
SHA5124c633ae038b55713d4ba913b265f57ae84d2ce5796d79668e845eeb19b9305d519bc8b77d435ffe3304dc2473b2287228c86678db818c0ff2f8f1987565c4f82
-
Filesize
144B
MD579e010824bb0aed683c6e07029a538c1
SHA1e290d57e8e07c21f4ee1cf59fd512233b901269b
SHA256164c1787a81d6be3f5341b593ceb555ba0f1ef5a6912b2c71090838b53172b8c
SHA51292740aa7335efa74db7a8ba930ae43c672ff19a735d53dff9132c2c462d30b770e48e2371641397e13c717a29c2280b1dd17cac40d9e66cd0f0fdef6c3dd5850
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
Filesize
5KB
MD5eb42f3528bf8e6869fb4900b575cb372
SHA1a4a46ab2bf3bc69fbc4c0d181363c22d614ff32c
SHA25620ab169b0145179c451114964f5beb4ec9869456fc4f759e8446be9850f43166
SHA5123f152f03511fc8fe9fc64d5debac9256041e0098551904987d1e2e80f33b8fd988d58f469b75d684f368f38a7be4b7519f872c0107f8eac600400a091e72ff02