Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 12:50
Behavioral task
behavioral1
Sample
b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe
-
Size
35KB
-
MD5
00d5f25a9e8ede3c90090feb4ded4a21
-
SHA1
e8ce25bb64be11f92509b3e6345747ebe88441fa
-
SHA256
b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167
-
SHA512
ad21388198bf985a04a3ec333b18fca597a92f099a5ee4755701c76d0b2db1c3a60cfdc71dfc31c26a4a9ed2068e6d95a54c83d89e15e610c5ef77a036bff825
-
SSDEEP
768:WYd514Ukgoj5O2yTuMVwOYQtH4czxYDXypY3s3DKHKTYF3ET1/hZR:W2GUJmOXubEtH4czxowY34Kqi3UZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4968 VRXECB6.tmp -
resource yara_rule behavioral2/memory/2496-132-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/2496-135-0x0000000000400000-0x0000000000425000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateCore.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\{18F127B1-7EA9-4BC3-9FD3-434ABBAC765F}\MicrosoftEdgeUpdateSetup_X86_1.3.167.21.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\orbd.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Windows Mail\wab.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2496 b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe 2496 b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2496 wrote to memory of 4968 2496 b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe 80 PID 2496 wrote to memory of 4968 2496 b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe 80 PID 2496 wrote to memory of 4968 2496 b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe"C:\Users\Admin\AppData\Local\Temp\b78d03e95e0b45909b1bb53bad70dd29c6fc60061934e0cca18108e5ce943167.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\VRXECB6.tmp"C:\Users\Admin\AppData\Local\Temp\VRXECB6.tmp"2⤵
- Executes dropped EXE
PID:4968
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5311e98757845111f6dfb38eee49d671e
SHA10c8693e2ce66427d3d39372cda98068175a49d62
SHA2569f5ddad5c105232eb4f7ae4fde359556e0f56ead115376f7aad44a8b51b04062
SHA512b3ec2a24dc92604efe3e23e7898a9fca3ed6f6aef98feb5269d5f2563d23179981f9d231da4186c0730339bf2fff68dc4147a093cd003f62a2835dab75d6e48e