Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f.exe
Resource
win7-20221111-en
General
-
Target
f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f.exe
-
Size
2.1MB
-
MD5
cda02e89168753004580b1218dca6f1e
-
SHA1
bb4ff4de9db6aba073a781e427f9b48e3c9b0103
-
SHA256
f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f
-
SHA512
06143c0e59cc7358cb251eb2eb54140735699f652ea63bb6991f7ad9b58eb1601b9362e3c9e425a884c599a6ff5b48a2dee9a2d1879852ec4e1c4000bf7f36c6
-
SSDEEP
24576:h1OYdaOhzoi5Fm2qmA+L4zKWQt0moNdqNFSj8y0j9jtaJB5ZuUUr2YGnEQ/VfVP:h1Os3mLmVJWQt0mozqW78bSVfVP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 212 HMqP3HyDsTfDr7N.exe -
Loads dropped DLL 3 IoCs
pid Process 212 HMqP3HyDsTfDr7N.exe 4516 regsvr32.exe 4800 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
description ioc Process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfokfiamdomfpjfamnpabjchemhhice\2.0\manifest.json HMqP3HyDsTfDr7N.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfokfiamdomfpjfamnpabjchemhhice\2.0\manifest.json HMqP3HyDsTfDr7N.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfokfiamdomfpjfamnpabjchemhhice\2.0\manifest.json HMqP3HyDsTfDr7N.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfokfiamdomfpjfamnpabjchemhhice\2.0\manifest.json HMqP3HyDsTfDr7N.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdfokfiamdomfpjfamnpabjchemhhice\2.0\manifest.json HMqP3HyDsTfDr7N.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ HMqP3HyDsTfDr7N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} HMqP3HyDsTfDr7N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects HMqP3HyDsTfDr7N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} HMqP3HyDsTfDr7N.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.dat HMqP3HyDsTfDr7N.exe File created C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.x64.dll HMqP3HyDsTfDr7N.exe File opened for modification C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.x64.dll HMqP3HyDsTfDr7N.exe File created C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.dll HMqP3HyDsTfDr7N.exe File opened for modification C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.dll HMqP3HyDsTfDr7N.exe File created C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.tlb HMqP3HyDsTfDr7N.exe File opened for modification C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.tlb HMqP3HyDsTfDr7N.exe File created C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.dat HMqP3HyDsTfDr7N.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 212 HMqP3HyDsTfDr7N.exe 212 HMqP3HyDsTfDr7N.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1044 wrote to memory of 212 1044 f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f.exe 83 PID 1044 wrote to memory of 212 1044 f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f.exe 83 PID 1044 wrote to memory of 212 1044 f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f.exe 83 PID 212 wrote to memory of 4516 212 HMqP3HyDsTfDr7N.exe 85 PID 212 wrote to memory of 4516 212 HMqP3HyDsTfDr7N.exe 85 PID 212 wrote to memory of 4516 212 HMqP3HyDsTfDr7N.exe 85 PID 4516 wrote to memory of 4800 4516 regsvr32.exe 86 PID 4516 wrote to memory of 4800 4516 regsvr32.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f.exe"C:\Users\Admin\AppData\Local\Temp\f110e682f443a54420c140db648e7bf59042712dcc3bc41f5de37049e52bd03f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\7zS201B.tmp\HMqP3HyDsTfDr7N.exe.\HMqP3HyDsTfDr7N.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\Kx4HK06deO8LeK.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:4800
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD54478fecaad80a0b3401ff76c1bbd75e0
SHA181ae76a84d117f688cef5fc04a45a1746c4ccf4b
SHA2567b0de8b78e756e836bb9b90ddfab916b4c99751bf5c7433415dbced774a1c0df
SHA512671671bbdd055a5fd8632c55103a4ae084d2fc5ea235950bf612ec6d257486f0150bb82df573ecbea527e4e9b4512d884f0e1d4290805bbfcf444dc8670c729a
-
Filesize
627KB
MD5ef0e781558e928c2959189bfd10fb730
SHA148231fa33eeb062e3e610c442bd5065a2f452ca6
SHA256b9e3d582ec3ff1cdb0bca396cfa19a66469a8b05576bf6af51b12d91b2b64586
SHA512679f07f56c98c800336ed312672dde579c3c17c6ae78e5a3df1b160d872ce2234426bbc3f144a2c0336c1e95cc6de6da466b5f579229748a39b7a3a0e4a6e802
-
Filesize
711KB
MD58029d3733e6148ef569ae3fb2f27a205
SHA161b763a7ee5893f8a0a8e0a0c291453361c31702
SHA2566cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6
SHA512535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456
-
Filesize
711KB
MD58029d3733e6148ef569ae3fb2f27a205
SHA161b763a7ee5893f8a0a8e0a0c291453361c31702
SHA2566cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6
SHA512535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456
-
Filesize
711KB
MD58029d3733e6148ef569ae3fb2f27a205
SHA161b763a7ee5893f8a0a8e0a0c291453361c31702
SHA2566cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6
SHA512535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456
-
Filesize
5KB
MD54478fecaad80a0b3401ff76c1bbd75e0
SHA181ae76a84d117f688cef5fc04a45a1746c4ccf4b
SHA2567b0de8b78e756e836bb9b90ddfab916b4c99751bf5c7433415dbced774a1c0df
SHA512671671bbdd055a5fd8632c55103a4ae084d2fc5ea235950bf612ec6d257486f0150bb82df573ecbea527e4e9b4512d884f0e1d4290805bbfcf444dc8670c729a
-
Filesize
627KB
MD5f172b0682fca8eb1e5c8dde6b837e387
SHA106561c1d33f425af65373cfd7752681edd356890
SHA256ca605e3f7654066bb6023bdaba995345e78ff8e25b3c5948ade4e37b8c57500e
SHA5120d5b3c18c412d9c4372b1e404ed2fe6b4a03a93cc8f21eae7b7596463d44cd8eec8dea8146c9727011063a8a31bc08b158604dedc9a728643330b08aaa9b6012
-
Filesize
627KB
MD5f172b0682fca8eb1e5c8dde6b837e387
SHA106561c1d33f425af65373cfd7752681edd356890
SHA256ca605e3f7654066bb6023bdaba995345e78ff8e25b3c5948ade4e37b8c57500e
SHA5120d5b3c18c412d9c4372b1e404ed2fe6b4a03a93cc8f21eae7b7596463d44cd8eec8dea8146c9727011063a8a31bc08b158604dedc9a728643330b08aaa9b6012
-
Filesize
627KB
MD5ef0e781558e928c2959189bfd10fb730
SHA148231fa33eeb062e3e610c442bd5065a2f452ca6
SHA256b9e3d582ec3ff1cdb0bca396cfa19a66469a8b05576bf6af51b12d91b2b64586
SHA512679f07f56c98c800336ed312672dde579c3c17c6ae78e5a3df1b160d872ce2234426bbc3f144a2c0336c1e95cc6de6da466b5f579229748a39b7a3a0e4a6e802
-
Filesize
3KB
MD5ca7a16e39808f225fbd1abd72fdf15b2
SHA1a256de866b7b53a8124c487a496bfc5c31d83998
SHA256b85b955b7f1a0de04289a427bc1fef945c9c203a1c5715b1fdd7b2703b424260
SHA512b534df49d91f5e68961d3aecd44a0ef404244b7e7ff7bca5a9cb910f1de366272ba34a4a11bf4c691ee4d8f0f155a6f4f2b57781ecbea6cc4646d32907a1afcf
-
Filesize
711KB
MD58029d3733e6148ef569ae3fb2f27a205
SHA161b763a7ee5893f8a0a8e0a0c291453361c31702
SHA2566cedfeedf3965d9c9f4a9abf117cde7021368f3dba113d5caddc888d2bc090d6
SHA512535fd23dd28be5a7d99d9269f3344dbf3e47ff2f4c47778ff9db196ade92bdcb28efd8a463603b82332e5f7c6938eaabd2a3dae5258b5c61fa7fa283bc074456
-
C:\Users\Admin\AppData\Local\Temp\7zS201B.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS201B.tmp\[email protected]\chrome.manifest
Filesize35B
MD548edae3e9d583b47175f9260adac8ae5
SHA15e2792c7c3d5744893c0c0ace190638809e66a71
SHA25660ab050d95625f6e34c8a109d95461f1dbafae892184d39ab8908e63cedeae9b
SHA5124ff22523c0bae4deaa662b479e3529a048df0ffc9bb11d62b2e39a2449ae527103b915215fb34f722f86a7c20bac84c3593edf6c9d415fb22bb5511004a93da1
-
C:\Users\Admin\AppData\Local\Temp\7zS201B.tmp\[email protected]\content\bg.js
Filesize7KB
MD5d4fda0ac8b4793ff1f66ebad647d80b9
SHA15712a26b7f775d34191a4da15d0d65e9819bb735
SHA2565fcdac4a912528c54239a0dadbe4cb4732e245b9e76ebd5a796532e7d6031b03
SHA512cefababa750bc65b660f1dd193fbd9705ff32fcf3dda8af7b2458ab5c80bb8e9b2d82a717c7cf05ed5eafaae655b2fde3fb0e409b0748ff55c6642f9dd72d4e9
-
C:\Users\Admin\AppData\Local\Temp\7zS201B.tmp\[email protected]\install.rdf
Filesize592B
MD58ba2abf67c2ad33a0ab1431a3dbfd92f
SHA1564a9827ae9b52248ed2b80a2fda3f780d8b91b2
SHA256f0b6536eb0454b4016b582653865df895f0da626a673221e5838f1d7c03e112a
SHA5129f7f724a441e781da15218ac218bc1d6931d126b36f8dc6edbc3efc33e59dfe48b9e0f0eff2fdf11b643a18c3fc5bb17aafa37ecc741d2de97457bffdf5942c6
-
Filesize
143B
MD5261731fc1725142ee3da5ed35b116d42
SHA1a6da7c3475942a667f833fdc0a039374b4dd08eb
SHA256b8ce6b679818150db597c27b1cd0e59e76454e1854ff6bd7c32a2fb46a0531ae
SHA512b2f22e994dd1eb068732ae3e6aeced8506cc33e3cdebf98bcba39bb447a7dc03371b9480811f393854247b3dc16ad6d724054f706bcf4e3e56bcceef523cf1d9
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
Filesize
5KB
MD5d3fd0a08318548160565cd9376dce9d7
SHA1acc5a49b6171e651e2f7eebfc4c6248431fb0ba9
SHA2565a14de144605e48a010208a8be6588cab20fd60ef2dd96da64b20a6ec2ef5bc2
SHA5128a1950fdb4f9eea6cee07b2f166bb6680ebeb9e9aff83d665e13c29c47a0975ff153d20530e9686cacb491721c855bbe8f493ff3177c79df3ab37d05ac139015