Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe
Resource
win7-20220812-en
General
-
Target
9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe
-
Size
292KB
-
MD5
977d6201a366a1dd0d3a7c36c2bb3b67
-
SHA1
0d09c75a78a68d274bdc67eea184d492a4d9c569
-
SHA256
9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2
-
SHA512
89b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0
-
SSDEEP
6144:4DClU9LocwcrcywT4DMezsW+PsBl2Zh+hH80PsKKifn4m+8:Hy9LocwBT4DMefmMlY+58nKjf4
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 224 PublishJoin.exe 1392 PublishJoin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4252 set thread context of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 224 set thread context of 1392 224 PublishJoin.exe 83 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 224 PublishJoin.exe 224 PublishJoin.exe 1392 PublishJoin.exe 1392 PublishJoin.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSecurityPrivilege 4092 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe Token: SeSecurityPrivilege 4092 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 224 PublishJoin.exe 224 PublishJoin.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4252 wrote to memory of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 4252 wrote to memory of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 4252 wrote to memory of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 4252 wrote to memory of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 4252 wrote to memory of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 4252 wrote to memory of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 4252 wrote to memory of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 4252 wrote to memory of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 4252 wrote to memory of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 4252 wrote to memory of 4092 4252 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 81 PID 4092 wrote to memory of 224 4092 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 82 PID 4092 wrote to memory of 224 4092 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 82 PID 4092 wrote to memory of 224 4092 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 82 PID 224 wrote to memory of 1392 224 PublishJoin.exe 83 PID 224 wrote to memory of 1392 224 PublishJoin.exe 83 PID 224 wrote to memory of 1392 224 PublishJoin.exe 83 PID 224 wrote to memory of 1392 224 PublishJoin.exe 83 PID 224 wrote to memory of 1392 224 PublishJoin.exe 83 PID 224 wrote to memory of 1392 224 PublishJoin.exe 83 PID 224 wrote to memory of 1392 224 PublishJoin.exe 83 PID 224 wrote to memory of 1392 224 PublishJoin.exe 83 PID 224 wrote to memory of 1392 224 PublishJoin.exe 83 PID 224 wrote to memory of 1392 224 PublishJoin.exe 83 PID 4092 wrote to memory of 3692 4092 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 84 PID 4092 wrote to memory of 3692 4092 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 84 PID 4092 wrote to memory of 3692 4092 9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe 84 PID 1392 wrote to memory of 1992 1392 PublishJoin.exe 86 PID 1392 wrote to memory of 1992 1392 PublishJoin.exe 86 PID 1392 wrote to memory of 1992 1392 PublishJoin.exe 86 PID 1392 wrote to memory of 1992 1392 PublishJoin.exe 86 PID 1392 wrote to memory of 1992 1392 PublishJoin.exe 86 PID 1392 wrote to memory of 1992 1392 PublishJoin.exe 86 PID 1392 wrote to memory of 1992 1392 PublishJoin.exe 86 PID 1392 wrote to memory of 1992 1392 PublishJoin.exe 86 PID 1392 wrote to memory of 1992 1392 PublishJoin.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe"C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exeC:\Users\Admin\AppData\Local\Temp\9f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\PublishJoin.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"5⤵PID:1992
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp2ceb799b.bat"3⤵PID:3692
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD5edc2911e937c4249395164ccd8730512
SHA193a5243125faae22707778da915e832818c56d95
SHA2569c460a590fe8157aab5f0122eb0f5cbf27fea7984522bb6f0305f948cd2e1b42
SHA5125186d8905bb1ef42673d2a6d2a8381a3a83633e5cf1ce0b3216250b6ec06293a44b67269ccfd918dd6b2c2f3565a28345b7f2140eff14f29b25d0ade4360f91c
-
Filesize
292KB
MD5977d6201a366a1dd0d3a7c36c2bb3b67
SHA10d09c75a78a68d274bdc67eea184d492a4d9c569
SHA2569f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2
SHA51289b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0
-
Filesize
292KB
MD5977d6201a366a1dd0d3a7c36c2bb3b67
SHA10d09c75a78a68d274bdc67eea184d492a4d9c569
SHA2569f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2
SHA51289b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0
-
Filesize
292KB
MD5977d6201a366a1dd0d3a7c36c2bb3b67
SHA10d09c75a78a68d274bdc67eea184d492a4d9c569
SHA2569f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2
SHA51289b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0
-
Filesize
292KB
MD5977d6201a366a1dd0d3a7c36c2bb3b67
SHA10d09c75a78a68d274bdc67eea184d492a4d9c569
SHA2569f03fdd6d560640a9433804d027e1390904e8d02c67deb7cb937e33437ec7ba2
SHA51289b4c18919b90239d9d66fcdac40ff8464df0341023cc612c7e77c7efbd313fd39648343d16bf767c3bfea5b4294ed1443448de9b0e1bdc56079926eabcd18b0