Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    25/11/2022, 20:00

General

  • Target

    f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f.exe

  • Size

    2.1MB

  • MD5

    cda02e89168753004580b1218dca6f1e

  • SHA1

    bb4ff4de9db6aba073a781e427f9b48e3c9b0103

  • SHA256

    f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f

  • SHA512

    06143c0e59cc7358cb251eb2eb54140735699f652ea63bb6991f7ad9b58eb1601b9362e3c9e425a884c599a6ff5b48a2dee9a2d1879852ec4e1c4000bf7f36c6

  • SSDEEP

    24576:h1OYdaOhzoi5Fm2qmA+L4zKWQt0moNdqNFSj8y0j9jtaJB5ZuUUr2YGnEQ/VfVP:h1Os3mLmVJWQt0mozqW78bSVfVP

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 3 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 11 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in Program Files directory 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f.exe
    "C:\Users\Admin\AppData\Local\Temp\f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\HMqP3HyDsTfDr7N.exe
      .\HMqP3HyDsTfDr7N.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1308
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s "C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.x64.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:992
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.x64.dll"
          4⤵
          • Loads dropped DLL
          • Installs/modifies Browser Helper Object
          PID:1712

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.dat

    Filesize

    5KB

    MD5

    4478fecaad80a0b3401ff76c1bbd75e0

    SHA1

    81ae76a84d117f688cef5fc04a45a1746c4ccf4b

    SHA256

    7b0de8b78e756e836bb9b90ddfab916b4c99751bf5c7433415dbced774a1c0df

    SHA512

    671671bbdd055a5fd8632c55103a4ae084d2fc5ea235950bf612ec6d257486f0150bb82df573ecbea527e4e9b4512d884f0e1d4290805bbfcf444dc8670c729a

  • C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.x64.dll

    Filesize

    711KB

    MD5

    8029d3733e6148ef569ae3fb2f27a205

    SHA1

    61b763a7ee5893f8a0a8e0a0c291453361c31702

    SHA256

    6cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6

    SHA512

    535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\HMqP3HyDsTfDr7N.dat

    Filesize

    5KB

    MD5

    4478fecaad80a0b3401ff76c1bbd75e0

    SHA1

    81ae76a84d117f688cef5fc04a45a1746c4ccf4b

    SHA256

    7b0de8b78e756e836bb9b90ddfab916b4c99751bf5c7433415dbced774a1c0df

    SHA512

    671671bbdd055a5fd8632c55103a4ae084d2fc5ea235950bf612ec6d257486f0150bb82df573ecbea527e4e9b4512d884f0e1d4290805bbfcf444dc8670c729a

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\HMqP3HyDsTfDr7N.exe

    Filesize

    627KB

    MD5

    f172b0682fca8eb1e5c8dde6b837e387

    SHA1

    06561c1d33f425af65373cfd7752681edd356890

    SHA256

    ca605e3f7654066bb6023bdaba995345e78ff8e25b3c5948ade4e37b8c57500e

    SHA512

    0d5b3c18c412d9c4372b1e404ed2fe6b4a03a93cc8f21eae7b7596463d44cd8eec8dea8146c9727011063a8a31bc08b158604dedc9a728643330b08aaa9b6012

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\HMqP3HyDsTfDr7N.exe

    Filesize

    627KB

    MD5

    f172b0682fca8eb1e5c8dde6b837e387

    SHA1

    06561c1d33f425af65373cfd7752681edd356890

    SHA256

    ca605e3f7654066bb6023bdaba995345e78ff8e25b3c5948ade4e37b8c57500e

    SHA512

    0d5b3c18c412d9c4372b1e404ed2fe6b4a03a93cc8f21eae7b7596463d44cd8eec8dea8146c9727011063a8a31bc08b158604dedc9a728643330b08aaa9b6012

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\Kx4HK06deO8LeK.dll

    Filesize

    627KB

    MD5

    ef0e781558e928c2959189bfd10fb730

    SHA1

    48231fa33eeb062e3e610c442bd5065a2f452ca6

    SHA256

    b9e3d582ec3ff1cdb0bca396cfa19a66469a8b05576bf6af51b12d91b2b64586

    SHA512

    679f07f56c98c800336ed312672dde579c3c17c6ae78e5a3df1b160d872ce2234426bbc3f144a2c0336c1e95cc6de6da466b5f579229748a39b7a3a0e4a6e802

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\Kx4HK06deO8LeK.tlb

    Filesize

    3KB

    MD5

    ca7a16e39808f225fbd1abd72fdf15b2

    SHA1

    a256de866b7b53a8124c487a496bfc5c31d83998

    SHA256

    b85b955b7f1a0de04289a427bc1fef945c9c203a1c5715b1fdd7b2703b424260

    SHA512

    b534df49d91f5e68961d3aecd44a0ef404244b7e7ff7bca5a9cb910f1de366272ba34a4a11bf4c691ee4d8f0f155a6f4f2b57781ecbea6cc4646d32907a1afcf

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\Kx4HK06deO8LeK.x64.dll

    Filesize

    711KB

    MD5

    8029d3733e6148ef569ae3fb2f27a205

    SHA1

    61b763a7ee5893f8a0a8e0a0c291453361c31702

    SHA256

    6cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6

    SHA512

    535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    df13f711e20e9c80171846d4f2f7ae06

    SHA1

    56d29cda58427efe0e21d3880d39eb1b0ef60bee

    SHA256

    6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

    SHA512

    6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\[email protected]\chrome.manifest

    Filesize

    35B

    MD5

    48edae3e9d583b47175f9260adac8ae5

    SHA1

    5e2792c7c3d5744893c0c0ace190638809e66a71

    SHA256

    60ab050d95625f6e34c8a109d95461f1dbafae892184d39ab8908e63cedeae9b

    SHA512

    4ff22523c0bae4deaa662b479e3529a048df0ffc9bb11d62b2e39a2449ae527103b915215fb34f722f86a7c20bac84c3593edf6c9d415fb22bb5511004a93da1

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\[email protected]\content\bg.js

    Filesize

    7KB

    MD5

    d4fda0ac8b4793ff1f66ebad647d80b9

    SHA1

    5712a26b7f775d34191a4da15d0d65e9819bb735

    SHA256

    5fcdac4a912528c54239a0dadbe4cb4732e245b9e76ebd5a796532e7d6031b03

    SHA512

    cefababa750bc65b660f1dd193fbd9705ff32fcf3dda8af7b2458ab5c80bb8e9b2d82a717c7cf05ed5eafaae655b2fde3fb0e409b0748ff55c6642f9dd72d4e9

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\[email protected]\install.rdf

    Filesize

    592B

    MD5

    8ba2abf67c2ad33a0ab1431a3dbfd92f

    SHA1

    564a9827ae9b52248ed2b80a2fda3f780d8b91b2

    SHA256

    f0b6536eb0454b4016b582653865df895f0da626a673221e5838f1d7c03e112a

    SHA512

    9f7f724a441e781da15218ac218bc1d6931d126b36f8dc6edbc3efc33e59dfe48b9e0f0eff2fdf11b643a18c3fc5bb17aafa37ecc741d2de97457bffdf5942c6

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\kdfokfiamdomfpjfamnpabjchemhhice\background.html

    Filesize

    143B

    MD5

    261731fc1725142ee3da5ed35b116d42

    SHA1

    a6da7c3475942a667f833fdc0a039374b4dd08eb

    SHA256

    b8ce6b679818150db597c27b1cd0e59e76454e1854ff6bd7c32a2fb46a0531ae

    SHA512

    b2f22e994dd1eb068732ae3e6aeced8506cc33e3cdebf98bcba39bb447a7dc03371b9480811f393854247b3dc16ad6d724054f706bcf4e3e56bcceef523cf1d9

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\kdfokfiamdomfpjfamnpabjchemhhice\content.js

    Filesize

    144B

    MD5

    fca19198fd8af21016a8b1dec7980002

    SHA1

    fd01a47d14004e17a625efe66cc46a06c786cf40

    SHA256

    332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

    SHA512

    60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\kdfokfiamdomfpjfamnpabjchemhhice\lsdb.js

    Filesize

    531B

    MD5

    36d98318ab2b3b2585a30984db328afb

    SHA1

    f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

    SHA256

    ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

    SHA512

    6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\kdfokfiamdomfpjfamnpabjchemhhice\manifest.json

    Filesize

    498B

    MD5

    640199ea4621e34510de919f6a54436f

    SHA1

    dc65dbfad02bd2688030bd56ca1cab85917a9937

    SHA256

    e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af

    SHA512

    d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a

  • C:\Users\Admin\AppData\Local\Temp\7zSFF27.tmp\kdfokfiamdomfpjfamnpabjchemhhice\tidnEu.js

    Filesize

    5KB

    MD5

    d3fd0a08318548160565cd9376dce9d7

    SHA1

    acc5a49b6171e651e2f7eebfc4c6248431fb0ba9

    SHA256

    5a14de144605e48a010208a8be6588cab20fd60ef2dd96da64b20a6ec2ef5bc2

    SHA512

    8a1950fdb4f9eea6cee07b2f166bb6680ebeb9e9aff83d665e13c29c47a0975ff153d20530e9686cacb491721c855bbe8f493ff3177c79df3ab37d05ac139015

  • \Program Files (x86)\GoSave\Kx4HK06deO8LeK.dll

    Filesize

    627KB

    MD5

    ef0e781558e928c2959189bfd10fb730

    SHA1

    48231fa33eeb062e3e610c442bd5065a2f452ca6

    SHA256

    b9e3d582ec3ff1cdb0bca396cfa19a66469a8b05576bf6af51b12d91b2b64586

    SHA512

    679f07f56c98c800336ed312672dde579c3c17c6ae78e5a3df1b160d872ce2234426bbc3f144a2c0336c1e95cc6de6da466b5f579229748a39b7a3a0e4a6e802

  • \Program Files (x86)\GoSave\Kx4HK06deO8LeK.x64.dll

    Filesize

    711KB

    MD5

    8029d3733e6148ef569ae3fb2f27a205

    SHA1

    61b763a7ee5893f8a0a8e0a0c291453361c31702

    SHA256

    6cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6

    SHA512

    535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456

  • \Program Files (x86)\GoSave\Kx4HK06deO8LeK.x64.dll

    Filesize

    711KB

    MD5

    8029d3733e6148ef569ae3fb2f27a205

    SHA1

    61b763a7ee5893f8a0a8e0a0c291453361c31702

    SHA256

    6cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6

    SHA512

    535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456

  • \Users\Admin\AppData\Local\Temp\7zSFF27.tmp\HMqP3HyDsTfDr7N.exe

    Filesize

    627KB

    MD5

    f172b0682fca8eb1e5c8dde6b837e387

    SHA1

    06561c1d33f425af65373cfd7752681edd356890

    SHA256

    ca605e3f7654066bb6023bdaba995345e78ff8e25b3c5948ade4e37b8c57500e

    SHA512

    0d5b3c18c412d9c4372b1e404ed2fe6b4a03a93cc8f21eae7b7596463d44cd8eec8dea8146c9727011063a8a31bc08b158604dedc9a728643330b08aaa9b6012

  • memory/1712-78-0x000007FEFC181000-0x000007FEFC183000-memory.dmp

    Filesize

    8KB

  • memory/2044-54-0x0000000076941000-0x0000000076943000-memory.dmp

    Filesize

    8KB