Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2022, 00:10

General

  • Target

    62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22.exe

  • Size

    1.1MB

  • MD5

    9ab4a7fd7c64f150813c87cff907699d

  • SHA1

    861b166e242fddad72973365c6ca0d242e478e5b

  • SHA256

    62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22

  • SHA512

    bf9e75a71bcdfcf8834ddb4dc410bfec006b1770b59aa2543adb80742c66d780eab9453a37c7bf111af6fe688d473dcd84ddbbe28376a53d3d7108affcfb7098

  • SSDEEP

    24576:diQiGP3wIrpRPHaT72KocBZtPYDd8HunSyj:diePxBanoc5Wy+

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 62 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22.exe
    "C:\Users\Admin\AppData\Local\Temp\62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Quspupodwqfhie.tmp",Ritwuoaoyiy
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:4448
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 18907
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:1332
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:4040
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:4196
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
            3⤵
              PID:4940
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
              3⤵
                PID:1980
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 556
              2⤵
              • Program crash
              PID:1572
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2780 -ip 2780
            1⤵
              PID:4420
            • C:\Windows\System32\rundll32.exe
              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
              1⤵
                PID:4388
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\SysWOW64\svchost.exe -k LocalService
                1⤵
                • Loads dropped DLL
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:1932
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\configuration\nppdf32.dll",TwxDNkxQMg==
                  2⤵
                  • Loads dropped DLL
                  • Checks processor information in registry
                  PID:940

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\WindowsPowerShell\Configuration\nppdf32.dll

                Filesize

                814KB

                MD5

                559b0bf4d0449a93271fabee29341761

                SHA1

                1b0ccf4b8c4d3142916df51cd3b6365517da12e8

                SHA256

                c104b10934809ca8a6bc132397ead846b0af051bdde9294cb4e3c2bc6f5f3622

                SHA512

                78133af58277c389a9f7dcee848628621b4020e106ef4b99991217177fb2891260044c640ab7733723e313c487c23742d70ee077272379bda5b06732a010b032

              • C:\Program Files (x86)\WindowsPowerShell\Configuration\nppdf32.dll

                Filesize

                814KB

                MD5

                559b0bf4d0449a93271fabee29341761

                SHA1

                1b0ccf4b8c4d3142916df51cd3b6365517da12e8

                SHA256

                c104b10934809ca8a6bc132397ead846b0af051bdde9294cb4e3c2bc6f5f3622

                SHA512

                78133af58277c389a9f7dcee848628621b4020e106ef4b99991217177fb2891260044c640ab7733723e313c487c23742d70ee077272379bda5b06732a010b032

              • C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\CiST0000.002

                Filesize

                64KB

                MD5

                3e4bb54c051fc02969e33f2aa7f3c802

                SHA1

                2ba3505713fd4b2f518c7e8690f76c39bec443d0

                SHA256

                6c3ae1e244b033fdcf5e1b2694a505614f7f994605b80881257042fa419cf035

                SHA512

                758dceef70a2839b6b3230fcd670dd5f4f6b9278cede9d4006fceb415afbd26e0b6bd01c5d39b8a2937e914a80d8d4fda547157c8d4ddce3c86b693f79a81f40

              • C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe.xml

                Filesize

                15KB

                MD5

                c73eeb9dedd94a612969e003260e6341

                SHA1

                0451277183bad12e3179c12c0a14694fab52bc8d

                SHA256

                1ee54a9294af6727770aff79f2c901cd40ca23dfb4803788042aada54146e355

                SHA512

                d78542d9c74efeac1d925d9d05c691c5543d04e6b671a5ef160f0fafc3b4444d327cf37206d78f43b607f817b6545cb9673b85d713b8c59d0c97103aee55245a

              • C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe.xml

                Filesize

                839B

                MD5

                2f6bc19cc3de731b8eaec46910edaf83

                SHA1

                61fd41f1fd1e4c6d7178a204c8ab68add839a199

                SHA256

                6893a54cc402ac94a278294c20918a5a6d15f8bf11995a8b2388dbe9fce5b966

                SHA512

                841a7777d1cf45ae391a101a44a25407023dd66e539e303057f0bfd01db8b37f56f9047eeccb920a5cdaa3ce44779d1703235a2db510594f70bbd2eff441b15a

              • C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\MicrosoftOffice2010Win32.xml

                Filesize

                71KB

                MD5

                b08a8c2f6941a1a12aa05180aec1dbb9

                SHA1

                c09f9207502aca3866b182d79221addcca76f4d1

                SHA256

                843f89d7b8b11907ee5dea2e0108dbb10ce3883d3b7505c55f4e1082db879d3f

                SHA512

                8de3748bd731835154f3d371ca0174c2b17da64fd39d479b132947304e6ff1d7f95e344aad64b6b9aa831ae37b3ed00d3a05efaf6aed67619e9d69a1e9b89bf7

              • C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\MicrosoftOffice2016Win32.xml

                Filesize

                64KB

                MD5

                fb54ecf5bbc8554d4218fce2b5863f04

                SHA1

                5a43e92271d69b66f97c12d977c10bc78991f76f

                SHA256

                bc964a0306fbeca377d20bafd127425c0700ee293a2c5caf9b28285f1b1d75e5

                SHA512

                c13e3d7c8801b9a865952708af0fe4272e2034be0ebc40e94f4bdccd13b3075ef8d2b5ec8af68d51fe11d87ce84183275d031390aa00e6cefd02407a03436a40

              • C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\Uyoiheuooe.tmp

                Filesize

                3.5MB

                MD5

                47e59ee97a2df9617c76376ed3d628ec

                SHA1

                e94718a947fd2c51914c46668979cee0574f7839

                SHA256

                59ea2549c3f043079f1dca222de3a0226d82c197fd160abd3cb840a311dbd762

                SHA512

                aeb4d8f19b2b138f847b5fe68f84c22815ea13a882948e400411eda3e3c74ffc8bbbc1b5055bed176a8ba884edba1e0bfc0f9fa3d7de503d6aa97372dab6f7f6

              • C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\Uyoiheuooe.tmp

                Filesize

                3.5MB

                MD5

                47e59ee97a2df9617c76376ed3d628ec

                SHA1

                e94718a947fd2c51914c46668979cee0574f7839

                SHA256

                59ea2549c3f043079f1dca222de3a0226d82c197fd160abd3cb840a311dbd762

                SHA512

                aeb4d8f19b2b138f847b5fe68f84c22815ea13a882948e400411eda3e3c74ffc8bbbc1b5055bed176a8ba884edba1e0bfc0f9fa3d7de503d6aa97372dab6f7f6

              • C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\netfol.ico

                Filesize

                28KB

                MD5

                3fa8c6dc1f72c3f9f8670a3e236459f2

                SHA1

                fcca30e9c5f861ac907150c76ca5f2174d214b7b

                SHA256

                dca1bd2f368d6165695ac6f48239722b9d38226bef45764a0076bbfa184cb0a7

                SHA512

                af6654f32cf0638204293e0117ff43e59f68537e391d3f4b1c7758632767eaa474d7cb44f3b4b7f9ba6cdefda9ec9368cf07814aed4e79949001bd44ede262ec

              • C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\pictures.ico

                Filesize

                81KB

                MD5

                8e3fed079e101c5dcb906371c2b546a3

                SHA1

                7fbf444c9361684228f643984f1333c271e86bf2

                SHA256

                b0203f1dc9e443dc5081b0f882934241645a5de4cc4b1e47b3460d17446a87d4

                SHA512

                898c825d9f20f3d20cb389328561ff70bd0c762dcc1369bd0bb633130aee9dcf60b433da66c3a37dd1d46a70614abd955a323589917ed85e0ec5698cdd0268c2

              • C:\ProgramData\{9C0BA6AF-75FB-72C6-BE9A-B167A4AE4026}\telemetry.P-ARIA-5476d0c4a7a347909c4b8a13078d4390-f8bdcecf-243f-40f8-b7c3-b9c44a57dead-7230.json

                Filesize

                121B

                MD5

                70bdaa5c409965a452e47aa001033c53

                SHA1

                594fad49def244b2a459ddd86bf1763e190917e3

                SHA256

                433ea519024b5837e58afc7f968df10b5fc3144b4da790c68a72c40740bdfa58

                SHA512

                62f25a4e598f3592cb8bb789ae4127c067fbcb3c738983f8da49996c9bdc981cebe266c666a416abe5cda8f321c8d62aa60da87dc77aef1843035dcb5400dbcc

              • C:\Users\Admin\AppData\Local\Temp\Quspupodwqfhie.tmp

                Filesize

                814KB

                MD5

                f93876956e6e2f754c8be97ac269729d

                SHA1

                bf0eb05f31b4177e5e2fdeb203698d5018c8ee12

                SHA256

                226eac6b8ce415bf0900050818f8212129fc51d14dab026e7b8600aa89d65c8a

                SHA512

                c3c53aca227ac035ac838002c8f68b2d449ac983a85780356eb8ef7791171fdb2133cf7f8b694cd4e62b6239b5b8ca21013c483c797153dcd57ea845d4b458cb

              • C:\Users\Admin\AppData\Local\Temp\Quspupodwqfhie.tmp

                Filesize

                814KB

                MD5

                f93876956e6e2f754c8be97ac269729d

                SHA1

                bf0eb05f31b4177e5e2fdeb203698d5018c8ee12

                SHA256

                226eac6b8ce415bf0900050818f8212129fc51d14dab026e7b8600aa89d65c8a

                SHA512

                c3c53aca227ac035ac838002c8f68b2d449ac983a85780356eb8ef7791171fdb2133cf7f8b694cd4e62b6239b5b8ca21013c483c797153dcd57ea845d4b458cb

              • \??\c:\program files (x86)\windowspowershell\configuration\nppdf32.dll

                Filesize

                814KB

                MD5

                559b0bf4d0449a93271fabee29341761

                SHA1

                1b0ccf4b8c4d3142916df51cd3b6365517da12e8

                SHA256

                c104b10934809ca8a6bc132397ead846b0af051bdde9294cb4e3c2bc6f5f3622

                SHA512

                78133af58277c389a9f7dcee848628621b4020e106ef4b99991217177fb2891260044c640ab7733723e313c487c23742d70ee077272379bda5b06732a010b032

              • memory/940-170-0x00000000046B0000-0x0000000005207000-memory.dmp

                Filesize

                11.3MB

              • memory/940-171-0x00000000046B0000-0x0000000005207000-memory.dmp

                Filesize

                11.3MB

              • memory/1332-148-0x0000000000460000-0x00000000006FD000-memory.dmp

                Filesize

                2.6MB

              • memory/1332-146-0x0000022DD81B0000-0x0000022DD82F0000-memory.dmp

                Filesize

                1.2MB

              • memory/1332-149-0x0000022DD6760000-0x0000022DD6A0E000-memory.dmp

                Filesize

                2.7MB

              • memory/1332-147-0x0000022DD81B0000-0x0000022DD82F0000-memory.dmp

                Filesize

                1.2MB

              • memory/1932-156-0x00000000037D0000-0x0000000004327000-memory.dmp

                Filesize

                11.3MB

              • memory/1932-168-0x00000000037D0000-0x0000000004327000-memory.dmp

                Filesize

                11.3MB

              • memory/1932-173-0x00000000037D0000-0x0000000004327000-memory.dmp

                Filesize

                11.3MB

              • memory/2780-137-0x0000000000400000-0x000000000053F000-memory.dmp

                Filesize

                1.2MB

              • memory/2780-136-0x0000000002330000-0x000000000245F000-memory.dmp

                Filesize

                1.2MB

              • memory/2780-135-0x0000000000797000-0x0000000000883000-memory.dmp

                Filesize

                944KB

              • memory/4448-142-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4448-152-0x0000000004500000-0x0000000005057000-memory.dmp

                Filesize

                11.3MB

              • memory/4448-144-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4448-143-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4448-141-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4448-140-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4448-139-0x0000000005120000-0x0000000005260000-memory.dmp

                Filesize

                1.2MB

              • memory/4448-138-0x0000000004500000-0x0000000005057000-memory.dmp

                Filesize

                11.3MB