Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 14:56

General

  • Target

    4345d182c96a72986ec7c2c1b1d3e4015e1085764b86dc03b119784d42055a4e.exe

  • Size

    2.0MB

  • MD5

    828f641f9f191b59bea3a7acc019f2f7

  • SHA1

    14d27fdeab1c9ed6316c33d30f20a5bc3a00c026

  • SHA256

    4345d182c96a72986ec7c2c1b1d3e4015e1085764b86dc03b119784d42055a4e

  • SHA512

    bc0c530bdd42f098c1484ccf6d282642bd4dd331d3cff8e957dbeb0d1dde4feced99df0cff41db59b1f5e5e9bbe3d5a5cd82d7e660c5a89c7758e78ec37626a5

  • SSDEEP

    24576:h1OYdaOPSTrzeCSs8imZBnphJGK5L5do5bhpWp5YDa3u0ixtU6fjviyCoIeEPUrL:h1OsTfs8imRhJHL5W5VpgHir7rwy

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 9 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4345d182c96a72986ec7c2c1b1d3e4015e1085764b86dc03b119784d42055a4e.exe
    "C:\Users\Admin\AppData\Local\Temp\4345d182c96a72986ec7c2c1b1d3e4015e1085764b86dc03b119784d42055a4e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3524
    • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\9Qb8dggPsCw1Cek.exe
      .\9Qb8dggPsCw1Cek.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:920
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\pRicechop\3kfdPHZ8T2Mc3p.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\pRicechop\3kfdPHZ8T2Mc3p.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:4984

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\pRicechop\3kfdPHZ8T2Mc3p.dat

    Filesize

    6KB

    MD5

    5b6f61406d1760a313cc005c2ed0bc0a

    SHA1

    f5abe78706e0610bd8c98b3f494e3e22dea64682

    SHA256

    a40f1386627fe774931fe292fe724bc5ad841a2bf933bfb92723c1b42dbcf16c

    SHA512

    3c54ac8c1c8e0a3a2c39477489122f49ba550275a17dc17b91da688ad29fc75a1fee2ac7f046db1b4831f0c34b9ebc2a23311a5bfd96142a0cb68f63060afae3

  • C:\Program Files (x86)\pRicechop\3kfdPHZ8T2Mc3p.dll

    Filesize

    610KB

    MD5

    8c17652e3d7951221e9afeb07a4c71e6

    SHA1

    68aeb97e567f4e705d4126a60bd94ef567760b61

    SHA256

    4085d30c67ed3d336266d7dd5c2a1bfac8e6ba45f9240b31283e43ac9555ea24

    SHA512

    6f21a4058579e7babe1ee44199fc41bf282d6e0c92352c636f39160c7c9e61191f9eb4186dcba8f0a25cf51f97c181e3027f2bbcee9f723a85de159121655065

  • C:\Program Files (x86)\pRicechop\3kfdPHZ8T2Mc3p.x64.dll

    Filesize

    687KB

    MD5

    cd1a0489adc1f05fc31a65eb26e08c92

    SHA1

    95af9d7095d36dee3e4d2e2952ca1a199c2bb596

    SHA256

    b63804fa2e99e3bd6b8dac3e203cba731ae2317e1fdae32014a88ff40a7a4755

    SHA512

    52bc43818912822eb746196aea22b11287a914f156c2838e8c2bc01469758ac18f0575df3d05f7b37042e8c3fd88d5c905d69f359963d5d57c42d0bd7b073c19

  • C:\Program Files (x86)\pRicechop\3kfdPHZ8T2Mc3p.x64.dll

    Filesize

    687KB

    MD5

    cd1a0489adc1f05fc31a65eb26e08c92

    SHA1

    95af9d7095d36dee3e4d2e2952ca1a199c2bb596

    SHA256

    b63804fa2e99e3bd6b8dac3e203cba731ae2317e1fdae32014a88ff40a7a4755

    SHA512

    52bc43818912822eb746196aea22b11287a914f156c2838e8c2bc01469758ac18f0575df3d05f7b37042e8c3fd88d5c905d69f359963d5d57c42d0bd7b073c19

  • C:\Program Files (x86)\pRicechop\3kfdPHZ8T2Mc3p.x64.dll

    Filesize

    687KB

    MD5

    cd1a0489adc1f05fc31a65eb26e08c92

    SHA1

    95af9d7095d36dee3e4d2e2952ca1a199c2bb596

    SHA256

    b63804fa2e99e3bd6b8dac3e203cba731ae2317e1fdae32014a88ff40a7a4755

    SHA512

    52bc43818912822eb746196aea22b11287a914f156c2838e8c2bc01469758ac18f0575df3d05f7b37042e8c3fd88d5c905d69f359963d5d57c42d0bd7b073c19

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\3kfdPHZ8T2Mc3p.dll

    Filesize

    610KB

    MD5

    8c17652e3d7951221e9afeb07a4c71e6

    SHA1

    68aeb97e567f4e705d4126a60bd94ef567760b61

    SHA256

    4085d30c67ed3d336266d7dd5c2a1bfac8e6ba45f9240b31283e43ac9555ea24

    SHA512

    6f21a4058579e7babe1ee44199fc41bf282d6e0c92352c636f39160c7c9e61191f9eb4186dcba8f0a25cf51f97c181e3027f2bbcee9f723a85de159121655065

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\3kfdPHZ8T2Mc3p.tlb

    Filesize

    3KB

    MD5

    3fdfaa71c68f31e83daf46b214ff8c89

    SHA1

    fe4a9d2172e9a94570f46fc151b94f90db08da77

    SHA256

    2d4e42ee22cf2171777f6f2aa232df7a2ad3445b6988ee2f2666ec2a863aca93

    SHA512

    392faf168a97d35fc4fa414844cae3662d231f18d5db55891e6cf281f34cef590cb94f6a650565b5b2bdf2c0899dc872c432106449604079f3283da241f2a100

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\3kfdPHZ8T2Mc3p.x64.dll

    Filesize

    687KB

    MD5

    cd1a0489adc1f05fc31a65eb26e08c92

    SHA1

    95af9d7095d36dee3e4d2e2952ca1a199c2bb596

    SHA256

    b63804fa2e99e3bd6b8dac3e203cba731ae2317e1fdae32014a88ff40a7a4755

    SHA512

    52bc43818912822eb746196aea22b11287a914f156c2838e8c2bc01469758ac18f0575df3d05f7b37042e8c3fd88d5c905d69f359963d5d57c42d0bd7b073c19

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\9Qb8dggPsCw1Cek.dat

    Filesize

    6KB

    MD5

    5b6f61406d1760a313cc005c2ed0bc0a

    SHA1

    f5abe78706e0610bd8c98b3f494e3e22dea64682

    SHA256

    a40f1386627fe774931fe292fe724bc5ad841a2bf933bfb92723c1b42dbcf16c

    SHA512

    3c54ac8c1c8e0a3a2c39477489122f49ba550275a17dc17b91da688ad29fc75a1fee2ac7f046db1b4831f0c34b9ebc2a23311a5bfd96142a0cb68f63060afae3

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\9Qb8dggPsCw1Cek.exe

    Filesize

    616KB

    MD5

    635cb5d678a60649b001160eee29ac99

    SHA1

    bc20fcc84a4334d23a24a02d58a729c22131de6b

    SHA256

    0f282b21030d09877ba924618b9f8718aaa9893a4a62adb03c47c96aa98772c3

    SHA512

    e15e052d2310361a289fb56a3baa49f8a1a6289691eac2dca0e3a150a15c6fee2cbc8c7cd73a6b4b9f97bbdb4cda0ff733b5b3e01b73d0aa68553ad229683e1f

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\9Qb8dggPsCw1Cek.exe

    Filesize

    616KB

    MD5

    635cb5d678a60649b001160eee29ac99

    SHA1

    bc20fcc84a4334d23a24a02d58a729c22131de6b

    SHA256

    0f282b21030d09877ba924618b9f8718aaa9893a4a62adb03c47c96aa98772c3

    SHA512

    e15e052d2310361a289fb56a3baa49f8a1a6289691eac2dca0e3a150a15c6fee2cbc8c7cd73a6b4b9f97bbdb4cda0ff733b5b3e01b73d0aa68553ad229683e1f

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    b576ddde292508af3c39b9ab79143574

    SHA1

    42ab528575b6d83fb39f47efec13a8ccdb02ace5

    SHA256

    0b26fcae7e986480e44b9825fe551b1f00133f20f38b63766fe2a8489168c159

    SHA512

    6db1193c91373b499f623f3aa76ecb38b1842fd55554eeb1aee434101f401f8e6426320c415fc07469b9da20445d98d7395213d7765090392455cf3be9044db9

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    fb187301aadc9877d01f074880710235

    SHA1

    8775968ad37d76b7973bab0e7554abc72c32ce94

    SHA256

    200048910768dc3581e95ba6e65445c8e2d49df4479a9c1ecc42599f323540b3

    SHA512

    3c42c164cc133cf5abf72963f0a9efe31707d19c9857a91d6bb3076c6d880e7d1353f671629e5d3ed2885d5f5a872d84e1efb67fe7defe7dec1a375f702070e8

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\[email protected]\install.rdf

    Filesize

    593B

    MD5

    0abce689af6546e97cdb0c411c029138

    SHA1

    3db07234c0ffd9a3634f0a46486942b0e49b943d

    SHA256

    051ebdb989b443dfaaf5fb1d08c78b1552a1d36a558b9a0c0753054a3e53f8d0

    SHA512

    3be6442eb27dab19c89602c7d010f2f0c3d48bb3993798dc8253a7b908b7a586b7a160b086c9ed28ac54619e32b5c4ea15b55cfd0e5cc98c3d8b1f4435e82077

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\bdabldggdoigiclmopaocjpilebiomek\background.html

    Filesize

    138B

    MD5

    e610c64fcaf46c1f10309b2165f49370

    SHA1

    76168e031e1d07d2d52630bf76bc4907c6bbc9ae

    SHA256

    b31e69345000bb479ddcb3ca8005ee5f81636e82211e5028613ec0baae6f046f

    SHA512

    7d0a7933b4e5be05cf9a6476498051dbfba61be13e7fedc4d8fb694193c3045dc6564c5d607d63bfe657cedc6a0e86ff31317b9eb7492d34ef5aa9054d2374a1

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\bdabldggdoigiclmopaocjpilebiomek\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\bdabldggdoigiclmopaocjpilebiomek\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\bdabldggdoigiclmopaocjpilebiomek\manifest.json

    Filesize

    501B

    MD5

    3684a1dbfd75f8b09d82693265c72a39

    SHA1

    0749ed67aae76094be48f360d69207e191a688fd

    SHA256

    72dee1f2d3bdb445fb7ffe85f8aa7e695c967992a0c78b3ab724c38f4e9c9a7b

    SHA512

    38ea7f57366b95cee750f226b657f0d9ec76727f048e36237199801e759c7bd645e0951df5d9466e13fd45fed5a5484800851daed81292047603e3c8f586a1d6

  • C:\Users\Admin\AppData\Local\Temp\7zSDE7E.tmp\bdabldggdoigiclmopaocjpilebiomek\q.js

    Filesize

    5KB

    MD5

    cf8ab5968dd4dd18be0cb380caeb07ab

    SHA1

    80ac56c6402de1f30f6f496cd1650705b616406c

    SHA256

    1c5b3ee9ae76fc0136848455f781d5f98c7d4407f81022de98774f8b395b7210

    SHA512

    3cf83fe7196b351ac70465357e27ba04766b375c034a5ed4297e7fb68a32d499080ca9fc45f72104f813b7e33c51eaf92a879d20c6e5ac29a4bb19983d3acc8a