Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 06:03

General

  • Target

    9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe

  • Size

    292KB

  • MD5

    977d6201a366a1dd0d3a7c36c2bb3b67

  • SHA1

    0d09c75a78a68d274bdc67eea184d492a4d9c569

  • SHA256

    9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

  • SHA512

    89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

  • SSDEEP

    6144:4DClU9LocwcrcywT4DMezsW+PsBl2Zh+hH80PsKKifn4m+8:Hy9LocwBT4DMefmMlY+58nKjf4

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe
    "C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe
      C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:224
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1392
          • C:\Windows\SysWOW64\explorer.exe
            "C:\Windows\SysWOW64\explorer.exe"
            5⤵
              PID:1992
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp2ceb799b.bat"
          3⤵
            PID:3692

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp2ceb799b.bat

        Filesize

        307B

        MD5

        edc2911e937c4249395164ccd8730512

        SHA1

        93a5243125faae22707778da915e832818c56d95

        SHA256

        9c460a590fe8157aab5f0122eb0f5cbf27fea7984522bb6f0305f948cd2e1b42

        SHA512

        5186d8905bb1ef42673d2a6d2a8381a3a83633e5cf1ce0b3216250b6ec06293a44b67269ccfd918dd6b2c2f3565a28345b7f2140eff14f29b25d0ade4360f91c

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe

        Filesize

        292KB

        MD5

        977d6201a366a1dd0d3a7c36c2bb3b67

        SHA1

        0d09c75a78a68d274bdc67eea184d492a4d9c569

        SHA256

        9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

        SHA512

        89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe

        Filesize

        292KB

        MD5

        977d6201a366a1dd0d3a7c36c2bb3b67

        SHA1

        0d09c75a78a68d274bdc67eea184d492a4d9c569

        SHA256

        9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

        SHA512

        89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe

        Filesize

        292KB

        MD5

        977d6201a366a1dd0d3a7c36c2bb3b67

        SHA1

        0d09c75a78a68d274bdc67eea184d492a4d9c569

        SHA256

        9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

        SHA512

        89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startupx\system.pif

        Filesize

        292KB

        MD5

        977d6201a366a1dd0d3a7c36c2bb3b67

        SHA1

        0d09c75a78a68d274bdc67eea184d492a4d9c569

        SHA256

        9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2

        SHA512

        89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0

      • memory/1392-154-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

      • memory/1992-155-0x00000000014C0000-0x00000000014EC000-memory.dmp

        Filesize

        176KB

      • memory/4092-138-0x0000000000400000-0x0000000001400000-memory.dmp

        Filesize

        16.0MB

      • memory/4092-141-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

      • memory/4092-139-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

      • memory/4092-150-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

      • memory/4092-137-0x0000000000400000-0x0000000001400000-memory.dmp

        Filesize

        16.0MB

      • memory/4092-136-0x0000000000400000-0x0000000001400000-memory.dmp

        Filesize

        16.0MB

      • memory/4092-133-0x0000000000400000-0x0000000001400000-memory.dmp

        Filesize

        16.0MB

      • memory/4252-134-0x0000000000680000-0x0000000000684000-memory.dmp

        Filesize

        16KB