Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
22/12/2022, 00:10
General
-
Target
62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22.exe
-
Size
1.1MB
-
MD5
9ab4a7fd7c64f150813c87cff907699d
-
SHA1
861b166e242fddad72973365c6ca0d242e478e5b
-
SHA256
62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22
-
SHA512
bf9e75a71bcdfcf8834ddb4dc410bfec006b1770b59aa2543adb80742c66d780eab9453a37c7bf111af6fe688d473dcd84ddbbe28376a53d3d7108affcfb7098
-
SSDEEP
24576:diQiGP3wIrpRPHaT72KocBZtPYDd8HunSyj:diePxBanoc5Wy+
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 62 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22.exe"C:\Users\Admin\AppData\Local\Temp\62a7a101409ff42ca3021cd461864cb4c13ec7c3785b6759841dae3bcb897a22.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Quspupodwqfhie.tmp",Ritwuoaoyiy2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 189073⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 5562⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2780 -ip 27801⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\configuration\nppdf32.dll",TwxDNkxQMg==2⤵
- Loads dropped DLL
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
814KB
MD5559b0bf4d0449a93271fabee29341761
SHA11b0ccf4b8c4d3142916df51cd3b6365517da12e8
SHA256c104b10934809ca8a6bc132397ead846b0af051bdde9294cb4e3c2bc6f5f3622
SHA51278133af58277c389a9f7dcee848628621b4020e106ef4b99991217177fb2891260044c640ab7733723e313c487c23742d70ee077272379bda5b06732a010b032
-
Filesize
814KB
MD5559b0bf4d0449a93271fabee29341761
SHA11b0ccf4b8c4d3142916df51cd3b6365517da12e8
SHA256c104b10934809ca8a6bc132397ead846b0af051bdde9294cb4e3c2bc6f5f3622
SHA51278133af58277c389a9f7dcee848628621b4020e106ef4b99991217177fb2891260044c640ab7733723e313c487c23742d70ee077272379bda5b06732a010b032
-
Filesize
64KB
MD53e4bb54c051fc02969e33f2aa7f3c802
SHA12ba3505713fd4b2f518c7e8690f76c39bec443d0
SHA2566c3ae1e244b033fdcf5e1b2694a505614f7f994605b80881257042fa419cf035
SHA512758dceef70a2839b6b3230fcd670dd5f4f6b9278cede9d4006fceb415afbd26e0b6bd01c5d39b8a2937e914a80d8d4fda547157c8d4ddce3c86b693f79a81f40
-
Filesize
15KB
MD5c73eeb9dedd94a612969e003260e6341
SHA10451277183bad12e3179c12c0a14694fab52bc8d
SHA2561ee54a9294af6727770aff79f2c901cd40ca23dfb4803788042aada54146e355
SHA512d78542d9c74efeac1d925d9d05c691c5543d04e6b671a5ef160f0fafc3b4444d327cf37206d78f43b607f817b6545cb9673b85d713b8c59d0c97103aee55245a
-
Filesize
839B
MD52f6bc19cc3de731b8eaec46910edaf83
SHA161fd41f1fd1e4c6d7178a204c8ab68add839a199
SHA2566893a54cc402ac94a278294c20918a5a6d15f8bf11995a8b2388dbe9fce5b966
SHA512841a7777d1cf45ae391a101a44a25407023dd66e539e303057f0bfd01db8b37f56f9047eeccb920a5cdaa3ce44779d1703235a2db510594f70bbd2eff441b15a
-
Filesize
71KB
MD5b08a8c2f6941a1a12aa05180aec1dbb9
SHA1c09f9207502aca3866b182d79221addcca76f4d1
SHA256843f89d7b8b11907ee5dea2e0108dbb10ce3883d3b7505c55f4e1082db879d3f
SHA5128de3748bd731835154f3d371ca0174c2b17da64fd39d479b132947304e6ff1d7f95e344aad64b6b9aa831ae37b3ed00d3a05efaf6aed67619e9d69a1e9b89bf7
-
Filesize
64KB
MD5fb54ecf5bbc8554d4218fce2b5863f04
SHA15a43e92271d69b66f97c12d977c10bc78991f76f
SHA256bc964a0306fbeca377d20bafd127425c0700ee293a2c5caf9b28285f1b1d75e5
SHA512c13e3d7c8801b9a865952708af0fe4272e2034be0ebc40e94f4bdccd13b3075ef8d2b5ec8af68d51fe11d87ce84183275d031390aa00e6cefd02407a03436a40
-
Filesize
3.5MB
MD547e59ee97a2df9617c76376ed3d628ec
SHA1e94718a947fd2c51914c46668979cee0574f7839
SHA25659ea2549c3f043079f1dca222de3a0226d82c197fd160abd3cb840a311dbd762
SHA512aeb4d8f19b2b138f847b5fe68f84c22815ea13a882948e400411eda3e3c74ffc8bbbc1b5055bed176a8ba884edba1e0bfc0f9fa3d7de503d6aa97372dab6f7f6
-
Filesize
3.5MB
MD547e59ee97a2df9617c76376ed3d628ec
SHA1e94718a947fd2c51914c46668979cee0574f7839
SHA25659ea2549c3f043079f1dca222de3a0226d82c197fd160abd3cb840a311dbd762
SHA512aeb4d8f19b2b138f847b5fe68f84c22815ea13a882948e400411eda3e3c74ffc8bbbc1b5055bed176a8ba884edba1e0bfc0f9fa3d7de503d6aa97372dab6f7f6
-
Filesize
28KB
MD53fa8c6dc1f72c3f9f8670a3e236459f2
SHA1fcca30e9c5f861ac907150c76ca5f2174d214b7b
SHA256dca1bd2f368d6165695ac6f48239722b9d38226bef45764a0076bbfa184cb0a7
SHA512af6654f32cf0638204293e0117ff43e59f68537e391d3f4b1c7758632767eaa474d7cb44f3b4b7f9ba6cdefda9ec9368cf07814aed4e79949001bd44ede262ec
-
Filesize
81KB
MD58e3fed079e101c5dcb906371c2b546a3
SHA17fbf444c9361684228f643984f1333c271e86bf2
SHA256b0203f1dc9e443dc5081b0f882934241645a5de4cc4b1e47b3460d17446a87d4
SHA512898c825d9f20f3d20cb389328561ff70bd0c762dcc1369bd0bb633130aee9dcf60b433da66c3a37dd1d46a70614abd955a323589917ed85e0ec5698cdd0268c2
-
Filesize
121B
MD570bdaa5c409965a452e47aa001033c53
SHA1594fad49def244b2a459ddd86bf1763e190917e3
SHA256433ea519024b5837e58afc7f968df10b5fc3144b4da790c68a72c40740bdfa58
SHA51262f25a4e598f3592cb8bb789ae4127c067fbcb3c738983f8da49996c9bdc981cebe266c666a416abe5cda8f321c8d62aa60da87dc77aef1843035dcb5400dbcc
-
Filesize
814KB
MD5f93876956e6e2f754c8be97ac269729d
SHA1bf0eb05f31b4177e5e2fdeb203698d5018c8ee12
SHA256226eac6b8ce415bf0900050818f8212129fc51d14dab026e7b8600aa89d65c8a
SHA512c3c53aca227ac035ac838002c8f68b2d449ac983a85780356eb8ef7791171fdb2133cf7f8b694cd4e62b6239b5b8ca21013c483c797153dcd57ea845d4b458cb
-
Filesize
814KB
MD5f93876956e6e2f754c8be97ac269729d
SHA1bf0eb05f31b4177e5e2fdeb203698d5018c8ee12
SHA256226eac6b8ce415bf0900050818f8212129fc51d14dab026e7b8600aa89d65c8a
SHA512c3c53aca227ac035ac838002c8f68b2d449ac983a85780356eb8ef7791171fdb2133cf7f8b694cd4e62b6239b5b8ca21013c483c797153dcd57ea845d4b458cb
-
Filesize
814KB
MD5559b0bf4d0449a93271fabee29341761
SHA11b0ccf4b8c4d3142916df51cd3b6365517da12e8
SHA256c104b10934809ca8a6bc132397ead846b0af051bdde9294cb4e3c2bc6f5f3622
SHA51278133af58277c389a9f7dcee848628621b4020e106ef4b99991217177fb2891260044c640ab7733723e313c487c23742d70ee077272379bda5b06732a010b032
-
Filesize
11.3MB
-
Filesize
11.3MB
-
Filesize
2.6MB
-
Filesize
1.2MB
-
Filesize
2.7MB
-
Filesize
1.2MB
-
Filesize
11.3MB
-
Filesize
11.3MB
-
Filesize
11.3MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
944KB
-
Filesize
1.2MB
-
Filesize
11.3MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.3MB