Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 19:48

General

  • Target

    051049beec31277c84bc9378f7f1a2227a74b94df638d747e882e72b9f552626.exe

  • Size

    3.6MB

  • MD5

    87f9480819416e5d102df86c18bb1ae2

  • SHA1

    79f64af8df16bec1c64a3a1098d256b20b2bd19f

  • SHA256

    051049beec31277c84bc9378f7f1a2227a74b94df638d747e882e72b9f552626

  • SHA512

    e2d74167570ce1de2e24b24ea47c00b93e16dae68a8f55e1a5c2c16d547b25da14852682d39ae1018b1fdc64f8e2514a638900d0e6cfa62e5f10d313c3342ab7

  • SSDEEP

    98304:KGFKbFZmkAa3O0Ktgq333XYuyEdp68mEycu:PKbFjde0KtJH3XYuyUp68msu

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 5 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\051049beec31277c84bc9378f7f1a2227a74b94df638d747e882e72b9f552626.exe
    "C:\Users\Admin\AppData\Local\Temp\051049beec31277c84bc9378f7f1a2227a74b94df638d747e882e72b9f552626.exe"
    1⤵
    • Loads dropped DLL
    • Drops Chrome extension
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1260
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Program Files (x86)\PriceLess\GycFYEKljOwy9i.x64.dll"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:744
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Program Files (x86)\PriceLess\GycFYEKljOwy9i.x64.dll"
        3⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:3160
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    1⤵
      PID:5032
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
      1⤵
        PID:4784

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\PriceLess\GycFYEKljOwy9i.dat

        Filesize

        3KB

        MD5

        a7bb7a58cf1068a7df17bdd76e1c1f78

        SHA1

        da8cc8ae491df5caf93efec5366eba479a562453

        SHA256

        2ae3556deaa0b541028faeb96591eeee31898cb3a1bd91c66a39db6b6c0176bd

        SHA512

        0c5c7115e289b2ea150f129701f894720e8f58bacd4c01649d2a007e0d977be62d2f1dabd4a8e2253444cc8f74f6d96fa268bfae7b64ef88fe42f321a85ab4cf

      • C:\Program Files (x86)\PriceLess\GycFYEKljOwy9i.dll

        Filesize

        621KB

        MD5

        f83e1d285fd555033363c873a035eaa8

        SHA1

        8d9807732d3afc5b859f80a3d5d1ed9441fee8f5

        SHA256

        19eb0207cff8f32182b16f8bb2ac81d05ee68a8754e31146376fb39b2f7cb23d

        SHA512

        cf415d65d43ae65a3b3a5f17f5be51339784ca67cf387ab235a80474d8d02a21f5e32e80b93561140b9890bb718ce17e3c3471687a71bcc0aa7551560c400d80

      • C:\Program Files (x86)\PriceLess\GycFYEKljOwy9i.tlb

        Filesize

        3KB

        MD5

        8eaf79892b19435884ff045bce1315e4

        SHA1

        38c843500d6f1f40392038257d04352bb0e5974a

        SHA256

        c268494c35ce0a6d0f12480b319e01e4454f37f7f5e2a4dba3663d130ef0b392

        SHA512

        d98bb8ee1b4abe9ba2a3e924cafecd1a8f9880c9519ea7c5aaed645cb7a65d50dcc84c309a6e16f5a3c9b489271458fe3e211ae6efd9ee8f44509fbe7c9e221e

      • C:\Program Files (x86)\PriceLess\GycFYEKljOwy9i.x64.dll

        Filesize

        700KB

        MD5

        8f24dd048bd99349732315da3740ab6f

        SHA1

        9d3eed72ebbd7c80877da59f5112878f1a1e4be2

        SHA256

        eabbf9c6c7a760307bdb6413614d7240032b72ebc60e16b2a8bd54e2d8b70d6c

        SHA512

        627e307cec8e2b2c2b733d3c4f7a34b8daf34c6a26950e17eb9a9304da7f8bf0ace36d79508cd6955322b3afed4048dded631b6f55e534c594dc52d448a80f3a

      • C:\Program Files (x86)\PriceLess\GycFYEKljOwy9i.x64.dll

        Filesize

        700KB

        MD5

        8f24dd048bd99349732315da3740ab6f

        SHA1

        9d3eed72ebbd7c80877da59f5112878f1a1e4be2

        SHA256

        eabbf9c6c7a760307bdb6413614d7240032b72ebc60e16b2a8bd54e2d8b70d6c

        SHA512

        627e307cec8e2b2c2b733d3c4f7a34b8daf34c6a26950e17eb9a9304da7f8bf0ace36d79508cd6955322b3afed4048dded631b6f55e534c594dc52d448a80f3a

      • C:\Program Files (x86)\PriceLess\GycFYEKljOwy9i.x64.dll

        Filesize

        700KB

        MD5

        8f24dd048bd99349732315da3740ab6f

        SHA1

        9d3eed72ebbd7c80877da59f5112878f1a1e4be2

        SHA256

        eabbf9c6c7a760307bdb6413614d7240032b72ebc60e16b2a8bd54e2d8b70d6c

        SHA512

        627e307cec8e2b2c2b733d3c4f7a34b8daf34c6a26950e17eb9a9304da7f8bf0ace36d79508cd6955322b3afed4048dded631b6f55e534c594dc52d448a80f3a

      • memory/1260-132-0x0000000003820000-0x00000000038C2000-memory.dmp

        Filesize

        648KB