Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2023, 16:01

General

  • Target

    1a68049cbf1b4688599b85e0806ffaa489590aafb953a9e4c1850bff3f5957f5.exe

  • Size

    419KB

  • MD5

    598711bdb72dd8d58bcfffcb66840770

  • SHA1

    81523eb2bacf06b085e4a255909acc8e6e1a9ffe

  • SHA256

    1a68049cbf1b4688599b85e0806ffaa489590aafb953a9e4c1850bff3f5957f5

  • SHA512

    51581c70f249fb6c74bb56373cfa2e69225f6ab613f9866e0e0a2367b6a7aa63a32b5c4a70e3a3a30837c005755cfdb50586b6f4ab672e44d46fd69448d50706

  • SSDEEP

    6144:PLyoisKcUhmEZkeE8oc1Ke9qoNYs/T5DlBHvh1FjAXTM4xVe+ew:PmoisW8EZKQ4uH5RBHXFWTMEQ+

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1a68049cbf1b4688599b85e0806ffaa489590aafb953a9e4c1850bff3f5957f5.exe
    "C:\Users\Admin\AppData\Local\Temp\1a68049cbf1b4688599b85e0806ffaa489590aafb953a9e4c1850bff3f5957f5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4936
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1248
      2⤵
      • Program crash
      PID:3384
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4936 -ip 4936
    1⤵
      PID:4828

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4936-132-0x00000000074E0000-0x0000000007A84000-memory.dmp

      Filesize

      5.6MB

    • memory/4936-133-0x0000000002EC8000-0x0000000002EF6000-memory.dmp

      Filesize

      184KB

    • memory/4936-134-0x0000000002DF0000-0x0000000002E3B000-memory.dmp

      Filesize

      300KB

    • memory/4936-135-0x0000000000400000-0x0000000002C5B000-memory.dmp

      Filesize

      40.4MB

    • memory/4936-136-0x0000000007A90000-0x00000000080A8000-memory.dmp

      Filesize

      6.1MB

    • memory/4936-137-0x00000000080B0000-0x00000000081BA000-memory.dmp

      Filesize

      1.0MB

    • memory/4936-138-0x0000000007480000-0x0000000007492000-memory.dmp

      Filesize

      72KB

    • memory/4936-139-0x00000000081C0000-0x00000000081FC000-memory.dmp

      Filesize

      240KB

    • memory/4936-140-0x0000000008480000-0x00000000084E6000-memory.dmp

      Filesize

      408KB

    • memory/4936-141-0x0000000008B30000-0x0000000008BC2000-memory.dmp

      Filesize

      584KB

    • memory/4936-142-0x0000000008C30000-0x0000000008DF2000-memory.dmp

      Filesize

      1.8MB

    • memory/4936-143-0x0000000008E10000-0x000000000933C000-memory.dmp

      Filesize

      5.2MB

    • memory/4936-144-0x0000000000400000-0x0000000002C5B000-memory.dmp

      Filesize

      40.4MB