Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
28/12/2022, 13:10
General
-
Target
53c69e4600cd2f632a0c5b33f7787e492f36f1e2ef0236b197e5bcf3269ef8bf.exe
-
Size
1021KB
-
MD5
c63663ff26907f52a05e95e289bf260e
-
SHA1
704b85ca4354761a824b4c98cd65e59a0f185a16
-
SHA256
53c69e4600cd2f632a0c5b33f7787e492f36f1e2ef0236b197e5bcf3269ef8bf
-
SHA512
8ab8957a917734672d51d7596dbabdff43c65a5826e4a17fab8165ca84882fb3982ddb33a6bd398f3c804256953995dab4def08b90edafb423b057311e8ecfa5
-
SSDEEP
24576:pRhP55ZiAkX8/xRgKUqKWrwbYXXZq1i30:pRhxSAks/4KU8r2Os00
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53c69e4600cd2f632a0c5b33f7787e492f36f1e2ef0236b197e5bcf3269ef8bf.exe"C:\Users\Admin\AppData\Local\Temp\53c69e4600cd2f632a0c5b33f7787e492f36f1e2ef0236b197e5bcf3269ef8bf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp",Dioeeedresq2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 139963⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 5282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1960 -ip 19601⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\google\temp\combine_r_rhp..dll",klc72⤵
- Loads dropped DLL
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
792KB
MD52afb2d45f68f5067790381b9a94c32fb
SHA130052113d12202ee069eddc2d237cc0bc4ccf93a
SHA256b589a7ce2fb2d21b840ba4c49c0b50647b4c0c62ac59f53bbe1b1ca9e2676ad7
SHA51223194e9224fe51af96258180175186ca31696c2be432693c3236af5375648edce6fb48bc31967f868622ec12db0d21d076187242d4f083123b06b164872453bf
-
Filesize
792KB
MD52afb2d45f68f5067790381b9a94c32fb
SHA130052113d12202ee069eddc2d237cc0bc4ccf93a
SHA256b589a7ce2fb2d21b840ba4c49c0b50647b4c0c62ac59f53bbe1b1ca9e2676ad7
SHA51223194e9224fe51af96258180175186ca31696c2be432693c3236af5375648edce6fb48bc31967f868622ec12db0d21d076187242d4f083123b06b164872453bf
-
Filesize
77KB
MD550a33f3ee76c3f15703f82890efcc8c8
SHA1b24e99bb702478edcbbda43f75457e5833abdc95
SHA25677a2a4517a0c488c78bf9742e86de5af419d6c148346845d8b0f062d5f8a631a
SHA512f14e224c1582476f09f969f1e29d5e2fa7855b22aa6b35682e264da0fc6cafdc1d62022dde5032206e1d973382604d9ccfa7495ebf90578a55c9c74bac1e606e
-
Filesize
3.5MB
MD51556a1dc36d8cde607aa9411cfdc7d80
SHA1dc3816b606996bebbaea00c04c58deab876233ad
SHA256ac3667edc65b5236234f9f1e6abc134045efeb73b45188ceba0e8756e891d4f6
SHA5126e720486872701c2be2a554d7515c5585521586059a41fc1507329c9ff9db1209103a75b8fc3094eb205d97010bef5fa7a04c67e4ba1a8c4507b7bb3a606a828
-
Filesize
3.5MB
MD51556a1dc36d8cde607aa9411cfdc7d80
SHA1dc3816b606996bebbaea00c04c58deab876233ad
SHA256ac3667edc65b5236234f9f1e6abc134045efeb73b45188ceba0e8756e891d4f6
SHA5126e720486872701c2be2a554d7515c5585521586059a41fc1507329c9ff9db1209103a75b8fc3094eb205d97010bef5fa7a04c67e4ba1a8c4507b7bb3a606a828
-
Filesize
6KB
MD5d218cf550fbd777e789242cafb804d10
SHA105175dd84f05a7989944e48db6a811c297fa47e3
SHA2568143763940b906ea93cd7288a08f251203d9f21da5282a6c20201ea7530df8c4
SHA5129134ace4de9b6bae58b161af4ede7ca9b24bd396c6b1e24ec8301ecb90278bc8b61d7600be7248b2f35acc49b83fcd627045f18c61ee57a2da0e19d61330261d
-
Filesize
957B
MD506f405331f1f99bd455f4afa7b8ee0cc
SHA1815d8d81c01208aef4bc1a0048b2d4f4171b26f6
SHA256b752d2c5a3c66c338fd6cd92224d5995be0eac8fd47092b8cd6ea2cc28a5e790
SHA512a2a771f97346a5db7ee8e948cba2c9e223848e1c395eb335a6e3609739c125e0414e7a254f5ac81ca4a28b04cf4e631ee69edaaf24ef534b96c01c30f96c3a2c
-
Filesize
3KB
MD51a3168a15983b890b16390a23a89a02e
SHA1d56ce16d88d79159a27c2d1cd3770dc56d897ebe
SHA256334782208e9520975f597b19a273fcc6f3a8a7caffd2e4fb22213f6b957f4946
SHA512f2be33992fd70d90eb94973c19924229bb70da4ce21c9777cfccbf56b0635452b382d2846afe2b0cc80a83d3b6a2c855557855cfb22fc681d182b2b605daa668
-
Filesize
768KB
MD5cfd8bc1980899dfc1055a186293bdc06
SHA1bf4e88bd2ca2c55725a8268fe05798faa83ee53b
SHA256dec3a3edaa6ee1b8c7f590e7047fb77558a2ecc07c59ce27d65c8496ba9d6be4
SHA51271debd30152c40ce4add8b38396266db97581a2f5c77df70ba901419afe3aba1120c9aa2332d4f8c984d1392b1ba4b60ec10f63022e1e61aded0ec93c78f3ca3
-
Filesize
5KB
MD5d7ee4543371744836d520e0ce24a9ee6
SHA1a6cda6aac3e480b269b9da2bd616bdb4d6fa87f0
SHA25698817a572430813ca4ca2787dab20573f7864c5168ac6912f34d14b49e7bd7c9
SHA512e15b6a50d9d498918a81488bf8d60860027f9a38f4d87e239f1c6e9d20fe4938e75861dad35c69e4087370c18b2cd5b482ab6ca694dfe205d053f1d303d17808
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD52afb2d45f68f5067790381b9a94c32fb
SHA130052113d12202ee069eddc2d237cc0bc4ccf93a
SHA256b589a7ce2fb2d21b840ba4c49c0b50647b4c0c62ac59f53bbe1b1ca9e2676ad7
SHA51223194e9224fe51af96258180175186ca31696c2be432693c3236af5375648edce6fb48bc31967f868622ec12db0d21d076187242d4f083123b06b164872453bf
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
856KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
2.7MB
-
Filesize
2.6MB
-
Filesize
1.2MB
-
Filesize
2.7MB
-
Filesize
1.2MB
