Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 20:07
Static task
static1
Behavioral task
behavioral1
Sample
b1191d3a2ab782a8dc42cef7ecd6a1878e2f790b2a5407c5b135573cf1179a94.exe
Resource
win7-20220901-en
General
-
Target
b1191d3a2ab782a8dc42cef7ecd6a1878e2f790b2a5407c5b135573cf1179a94.exe
-
Size
2.1MB
-
MD5
4d08a5908edf386cf0af9ce1ae021539
-
SHA1
22ce2c944a43d984c0fb698d8c7b3b76d88ff3fe
-
SHA256
b1191d3a2ab782a8dc42cef7ecd6a1878e2f790b2a5407c5b135573cf1179a94
-
SHA512
aba37d9618f5c945939daea011a64f9738f52679f0dc579ad5d06f12559c7cc1dea7ed1762449b07e7c31b518f1de26a3cfbbfad33d42cd99a9f6d84a1c456bb
-
SSDEEP
49152:h1OsJBNPM6n5oHCZdw3CyvHht6wqM7M1cHf:h1OoBjn5oHCZMDvHhrqMM0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4944 VOwEba2j1uhPLUQ.exe -
Loads dropped DLL 3 IoCs
pid Process 4944 VOwEba2j1uhPLUQ.exe 4740 regsvr32.exe 1296 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jclheonggjeopepfibfdfdlhpnpfpdde\200\manifest.json VOwEba2j1uhPLUQ.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jclheonggjeopepfibfdfdlhpnpfpdde\200\manifest.json VOwEba2j1uhPLUQ.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jclheonggjeopepfibfdfdlhpnpfpdde\200\manifest.json VOwEba2j1uhPLUQ.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jclheonggjeopepfibfdfdlhpnpfpdde\200\manifest.json VOwEba2j1uhPLUQ.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jclheonggjeopepfibfdfdlhpnpfpdde\200\manifest.json VOwEba2j1uhPLUQ.exe -
Installs/modifies Browser Helper Object 2 TTPs 9 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ VOwEba2j1uhPLUQ.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} VOwEba2j1uhPLUQ.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} VOwEba2j1uhPLUQ.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects VOwEba2j1uhPLUQ.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{DBC80044-A445-435B-BC74-9C25C1C588A9} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regsvr32.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Browser Shop\phRPp83gWav3R4.dat VOwEba2j1uhPLUQ.exe File created C:\Program Files (x86)\Browser Shop\phRPp83gWav3R4.x64.dll VOwEba2j1uhPLUQ.exe File opened for modification C:\Program Files (x86)\Browser Shop\phRPp83gWav3R4.x64.dll VOwEba2j1uhPLUQ.exe File created C:\Program Files (x86)\Browser Shop\phRPp83gWav3R4.dll VOwEba2j1uhPLUQ.exe File opened for modification C:\Program Files (x86)\Browser Shop\phRPp83gWav3R4.dll VOwEba2j1uhPLUQ.exe File created C:\Program Files (x86)\Browser Shop\phRPp83gWav3R4.tlb VOwEba2j1uhPLUQ.exe File opened for modification C:\Program Files (x86)\Browser Shop\phRPp83gWav3R4.tlb VOwEba2j1uhPLUQ.exe File created C:\Program Files (x86)\Browser Shop\phRPp83gWav3R4.dat VOwEba2j1uhPLUQ.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4944 VOwEba2j1uhPLUQ.exe 4944 VOwEba2j1uhPLUQ.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4772 wrote to memory of 4944 4772 b1191d3a2ab782a8dc42cef7ecd6a1878e2f790b2a5407c5b135573cf1179a94.exe 80 PID 4772 wrote to memory of 4944 4772 b1191d3a2ab782a8dc42cef7ecd6a1878e2f790b2a5407c5b135573cf1179a94.exe 80 PID 4772 wrote to memory of 4944 4772 b1191d3a2ab782a8dc42cef7ecd6a1878e2f790b2a5407c5b135573cf1179a94.exe 80 PID 4944 wrote to memory of 4740 4944 VOwEba2j1uhPLUQ.exe 81 PID 4944 wrote to memory of 4740 4944 VOwEba2j1uhPLUQ.exe 81 PID 4944 wrote to memory of 4740 4944 VOwEba2j1uhPLUQ.exe 81 PID 4740 wrote to memory of 1296 4740 regsvr32.exe 83 PID 4740 wrote to memory of 1296 4740 regsvr32.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1191d3a2ab782a8dc42cef7ecd6a1878e2f790b2a5407c5b135573cf1179a94.exe"C:\Users\Admin\AppData\Local\Temp\b1191d3a2ab782a8dc42cef7ecd6a1878e2f790b2a5407c5b135573cf1179a94.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\7zS9966.tmp\VOwEba2j1uhPLUQ.exe.\VOwEba2j1uhPLUQ.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\Browser Shop\phRPp83gWav3R4.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Browser Shop\phRPp83gWav3R4.x64.dll"4⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
PID:1296
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5e0db6086de9b0dea028ee2bb957c564b
SHA10cabd9484cc7f6d6a0aa2605e05f15ab9bfb8f9a
SHA256b4a673d81f12898e60dd465151561478c76bbcd45d75467c8cf54d9e7cc36a10
SHA5126ab12ef9040751d59c95b237c2756c78b9139b03c828d379a01a27e4945212ada2b44e55d3e7b32651d0de67b0114f47b6634063754cdd0eb044a2617d9774e6
-
Filesize
629KB
MD58f0476d4c7ef0c04523efe17f95ffff8
SHA1a7605f6101031e5eec2ae964b6ed9d8775434e9e
SHA2567277b7268f48043af02c5a6793e8c17cf815080bebef610fac956b3cb581d909
SHA51221a8056c7a7f1d14240f28543bcda3a19fceeebf5dff24da51f71f97a2d4a2c6bdb1e308051eff62b52efe25af5b5de0f88130f9dad2dc440697b7997de36429
-
Filesize
710KB
MD52d9b84b8a433eff58888a3240a3a4ff5
SHA1a59f591168b33de4f42b680fb66c7c7f78b11056
SHA2564df3323f9cfeb84add405bf9bf36445a22b368c1efb70e109200d94d880bfbb3
SHA5121cdc6571ae7a8708aaef77f566222aa7cad9da7a77e3e904a56fcfa9238bb6c9993bd455c7f336e4b14e63e61ec8cf4f710567b4b9f420c3133da6dddd10d23e
-
Filesize
710KB
MD52d9b84b8a433eff58888a3240a3a4ff5
SHA1a59f591168b33de4f42b680fb66c7c7f78b11056
SHA2564df3323f9cfeb84add405bf9bf36445a22b368c1efb70e109200d94d880bfbb3
SHA5121cdc6571ae7a8708aaef77f566222aa7cad9da7a77e3e904a56fcfa9238bb6c9993bd455c7f336e4b14e63e61ec8cf4f710567b4b9f420c3133da6dddd10d23e
-
Filesize
710KB
MD52d9b84b8a433eff58888a3240a3a4ff5
SHA1a59f591168b33de4f42b680fb66c7c7f78b11056
SHA2564df3323f9cfeb84add405bf9bf36445a22b368c1efb70e109200d94d880bfbb3
SHA5121cdc6571ae7a8708aaef77f566222aa7cad9da7a77e3e904a56fcfa9238bb6c9993bd455c7f336e4b14e63e61ec8cf4f710567b4b9f420c3133da6dddd10d23e
-
Filesize
6KB
MD5e0db6086de9b0dea028ee2bb957c564b
SHA10cabd9484cc7f6d6a0aa2605e05f15ab9bfb8f9a
SHA256b4a673d81f12898e60dd465151561478c76bbcd45d75467c8cf54d9e7cc36a10
SHA5126ab12ef9040751d59c95b237c2756c78b9139b03c828d379a01a27e4945212ada2b44e55d3e7b32651d0de67b0114f47b6634063754cdd0eb044a2617d9774e6
-
Filesize
657KB
MD5b831a4edee2ceadc357e0165ea586f14
SHA14bd2c00d1331f52acafd077cb358905bcc40a40b
SHA256917f3a961b2105519fa358adac37496671751a49a215922ddba8dd3f047c8627
SHA512805bb79c277be66d0ac821de3f5fe5fbdc2bedfcc5201868d354b63520cccd252b965f2e9c608cb678fc5f391050d42c466c9f79670bd591ea865912517cd6dd
-
Filesize
657KB
MD5b831a4edee2ceadc357e0165ea586f14
SHA14bd2c00d1331f52acafd077cb358905bcc40a40b
SHA256917f3a961b2105519fa358adac37496671751a49a215922ddba8dd3f047c8627
SHA512805bb79c277be66d0ac821de3f5fe5fbdc2bedfcc5201868d354b63520cccd252b965f2e9c608cb678fc5f391050d42c466c9f79670bd591ea865912517cd6dd
-
Filesize
5KB
MD5bf3fec4560cf8e502d45838dd5599a42
SHA1d824de26701965b287a13f956cec985c5c7d8679
SHA25611d059f6051a721c28fdb2761095bacd799e99ae072ac1114aff16e684420c2b
SHA512f6945400e0c92d08c0d77561d920adcdf5615bc2bcfc6eefbb42b4861806df04f66dcfde081754181f3670b225d60aedbb3e43edb135381bf510c7e00539fc9e
-
Filesize
146B
MD5738915e55a523b603196b6caa0e15283
SHA1334a493ea9b8589bd3d3e91417eef583b60e8c3f
SHA256563094e89ea6c6deaef8d85a32ea27a5cf66a79a0a8e8ff54cadd6850ffe7afa
SHA5129467b9f3ec59616b504f4f745e4a928364977f1ff177ae1a97089452da39b8039ff41f06a2932a923cc595968253cfa74feff3cb6f2a39d4105802a17079474c
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
504B
MD5d532994175ac6e4e8fea2ae07edef6ff
SHA15646eab3cebc8b0a804103b63f08a63db784a77d
SHA256f9a190f8cfafdeddfe9627366bcd108e42b7fa07c8d074f1570bd77489f39c4d
SHA512ba6ddc11423c0b0d93de3e3ecb9eeebe29470723282165aa67de4329a5f9af7e390869a7cbd0834c1ff115a1ed0a274bed686b4b6630e98b268ec1f2a9a8dadb
-
Filesize
629KB
MD58f0476d4c7ef0c04523efe17f95ffff8
SHA1a7605f6101031e5eec2ae964b6ed9d8775434e9e
SHA2567277b7268f48043af02c5a6793e8c17cf815080bebef610fac956b3cb581d909
SHA51221a8056c7a7f1d14240f28543bcda3a19fceeebf5dff24da51f71f97a2d4a2c6bdb1e308051eff62b52efe25af5b5de0f88130f9dad2dc440697b7997de36429
-
Filesize
3KB
MD5ad50e349afc1c3ffb845262f7fc97603
SHA1b0cc07253796476f702227739c5050247ca2b279
SHA2568f8d4fc042feb74d414a3a5a761dc5394a4b96f1e5bd818bd01208d0b3e1bcb0
SHA5126a11d1bab64ba21c5ce51faf209beb9d6a49e488a27a21e20e51f1d0216c8034be0442ceb351a942d3be4d2883c79495afffa776752dce0fd727a0a32e2740a2
-
Filesize
710KB
MD52d9b84b8a433eff58888a3240a3a4ff5
SHA1a59f591168b33de4f42b680fb66c7c7f78b11056
SHA2564df3323f9cfeb84add405bf9bf36445a22b368c1efb70e109200d94d880bfbb3
SHA5121cdc6571ae7a8708aaef77f566222aa7cad9da7a77e3e904a56fcfa9238bb6c9993bd455c7f336e4b14e63e61ec8cf4f710567b4b9f420c3133da6dddd10d23e
-
C:\Users\Admin\AppData\Local\Temp\7zS9966.tmp\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\7zS9966.tmp\[email protected]\chrome.manifest
Filesize35B
MD5eb95dfbd0e359522670bc83d02d82701
SHA1d9b8183ddf895d9deef7ea45ce8390bacca30a84
SHA2562fd549436bef2ad2fbb673234a195a3d11b62dbbb1482a2537fa2172333054b2
SHA512fc7bc998fd1778f87a9a07fa6e493a78b2c50bf73f14606b5b88d76627b317633d9f860f5a3068e2b9afa002b8c246d81c556564749161a557933dd26f2a2e58
-
C:\Users\Admin\AppData\Local\Temp\7zS9966.tmp\[email protected]\content\bg.js
Filesize7KB
MD50eef86d44fb00e448a8893ac1727fdc6
SHA130cc52a27c8c40496036a92f11a4df27b037285b
SHA2567d129c6ba0557d86c9ea698a9bb76e107b46305f83de63560dd25e8cbbc9e5a5
SHA512e16b175d729df5f4dbb4f39488cb91648143e4e7f10007696ab3d0535d4b51ed4a2395f158a69458d510552c1b055f28c8bef78e61f27d318bf5360443731053
-
C:\Users\Admin\AppData\Local\Temp\7zS9966.tmp\[email protected]\install.rdf
Filesize603B
MD5e255bc4ca9fbf37d2d952788e374c417
SHA174927553ab94d9fd185d5f96fd1178a9556def4c
SHA256b005430f2ecba82887e7a0109137d59033f7afb867dc560597fed62c740cd649
SHA5126b88b784f36d19215e8c2a7e1adbc6d4ab77707f347f80768152116bc5f2bacac8f0decfeef8f1a9b719565748de8ff05f62734dad993c7c60fba884cfe9337f