Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
10/01/2023, 15:20
General
-
Target
8109535327593a1bedfdca02434369e7524a393a769b766f8baa9c88fbce7d47.exe
-
Size
1.1MB
-
MD5
83735f17dd18f712f9fbcefa521395da
-
SHA1
30ebe706ec893dcb14ff0ce4eae6e548911d3459
-
SHA256
8109535327593a1bedfdca02434369e7524a393a769b766f8baa9c88fbce7d47
-
SHA512
4872228762a87819802e16f3b8226278cd4c6e5bc929d99b4cd8efb3cc059a7aa8b296eae5947b8fce9372d4a1d2e6f132446bdbd9923793d37020c9e836fa97
-
SSDEEP
24576:ADe1yTyabX7slOCwjiYacsj0p4dmmseJJ+DFXoxoxa1+Ow+aE:AD8mfiYacsIafseJJ+OexvE
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 5 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8109535327593a1bedfdca02434369e7524a393a769b766f8baa9c88fbce7d47.exe"C:\Users\Admin\AppData\Local\Temp\8109535327593a1bedfdca02434369e7524a393a769b766f8baa9c88fbce7d47.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Ryfererfh.tmp",Fwpthq2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 227893⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 5602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4936 -ip 49361⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\microsoft\temp\back-arrow-hover.dll",gkBCQjdCcQ==2⤵
- Loads dropped DLL
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
817KB
MD504944752e093ced72012cecb1b2889f7
SHA12c7f25b9350038f36f286a9a8d49ded89260b9ed
SHA2566b778fca7bdee2c754108987ec7c085a4e30c707ac7ac71290c2f2c920bfde25
SHA51249126d797a1ad6c24941744012d22d51bde409914b56b7d631e34cb85e8dc012f34ab61ca1cd9ca675fed868b12a7cb2dc073c4afd3de7a5f9bd3b01cae7bfc9
-
Filesize
817KB
MD504944752e093ced72012cecb1b2889f7
SHA12c7f25b9350038f36f286a9a8d49ded89260b9ed
SHA2566b778fca7bdee2c754108987ec7c085a4e30c707ac7ac71290c2f2c920bfde25
SHA51249126d797a1ad6c24941744012d22d51bde409914b56b7d631e34cb85e8dc012f34ab61ca1cd9ca675fed868b12a7cb2dc073c4afd3de7a5f9bd3b01cae7bfc9
-
Filesize
2KB
MD5d2d725a3c34b3597b164a038ec06085a
SHA152eb2334afeccafd46b205de0d2c7306cb7b7c8d
SHA25601bc9a89105cebd77ff81b814f794a71cbccf40f4d3e663758e63e202f5e1f00
SHA5126f23fc81a4a5308966892ef880048ff079aec5968af5d6fcc0315c05533d597865b0572d18e0368da4ff85c9136b87a4cb9e878bc28738a18025d576b5a3f306
-
Filesize
32KB
MD54e40dbba4bf3ea44a50ff74457aaf232
SHA11b79ebb121abfb9c431852f0f783dfd89ec19f01
SHA2560580713efb76985a3b2157d6f0b08665f8084243caad401a1faf53900564f935
SHA5120fbd8723391dfc132e24068c2c79094cc788cd9e996eac81f07f7c6c44904cc483eedb4a6ae116cdbff8d35b769179635a71ef1a95882a356ce73e56f10a2790
-
Filesize
3.5MB
MD52140d9c615363bd6a66b551411375b89
SHA1a3c05538eb384189bf3b194923806d0c55b27692
SHA256595cd43db10ac87ab472449d14617d3a4f770bbc5692cca700a3537778c23aed
SHA512dcab34c63d786bfd5dcce83d3960944b77cf45fe8a712e23ac75ac8a3a653415bb3e0cf85e2e047fc1eea949df6818e5d80989a69745ac914b3137b9460c71ab
-
Filesize
27KB
MD582c3ab31834272e4118e925922249240
SHA1a116ca5af39e39b7d4234c2c0cd6a91bff6727af
SHA25625b87fbabbec1d49eae7cf47c3d659cb6c99eb82203e90eee6035b21b425b5ef
SHA5124d3eaec898ef47e9b6039bcd481a06001263e7fcbc9303974423f90058a4d91494392427ca35dced5db642e8692580f24cb761b27a60e3288f15aefd8dbdb647
-
Filesize
2KB
MD5c8d6f0d26db52746e243b785c269cacd
SHA1b06dc537fb0bbd424c0bb0c7a5ee0a85839e04f1
SHA256d3352e34ef1b362934f938a2c2710261ca18c5e5e4922167a73539d945a95e21
SHA512c674886978f91b35978544ad18ceb54aa7b2d8dfd8d9e0ddb752854ef211539e79a24d553d9a1a91c7e6711743e2bbd70c24611dac063c2d61379cc7f8ef3020
-
Filesize
4KB
MD59591376a696c8d916d929921053db03a
SHA11ef94fd4f2cf9b0a3ba2557341a32b2d84c7b6f7
SHA2568b7ca1886f228bf4a4d4ebd5e053f8188ba2ddc988424c56460c85e6b4a70d67
SHA512c6776f57892e8fa31c255b3a2d2de5a523b9eebed5a1dd1894ef02a5ecd21da9fae241485d605aa617e1c2b78dea9206704579b26abe98f497903013301ef387
-
Filesize
12KB
MD5879dbf8cded6ac59df3fb0f32aa9eec6
SHA1844be6baee27e23e5821491fc9532269b1143142
SHA2563e0f02c2bd9c695d43963c9085e496ab42e7914bdc05f511d56442883c6c9687
SHA5122d3be800531b56ea768c458fbcb2a563df27a2c981b6e0203dd98559eda4772c93588374b12b5a239de64e63f0b922556bcccd68a3ea4ffcbb8e53740a9e65ab
-
Filesize
3KB
MD51a3168a15983b890b16390a23a89a02e
SHA1d56ce16d88d79159a27c2d1cd3770dc56d897ebe
SHA256334782208e9520975f597b19a273fcc6f3a8a7caffd2e4fb22213f6b957f4946
SHA512f2be33992fd70d90eb94973c19924229bb70da4ce21c9777cfccbf56b0635452b382d2846afe2b0cc80a83d3b6a2c855557855cfb22fc681d182b2b605daa668
-
Filesize
14KB
MD5fffde3df0d91311b7fe3f9bc8642a9ec
SHA150987906817aab51e2cc29fbce47ac5f0936a44e
SHA256bda9df3591bf7f67d4b31d23cffdcf927da6f00ae1b393f07aea69ba1c4344bc
SHA5125e0766c25f54b03ca0325966ba059cbfb9cdb0aeae567106583fdff944d67522516acabb9b261e2fd434c1a5af5c5453a09c9dc494008253b0553a993c01d3d3
-
Filesize
9KB
MD5f35965aa615dd128c2b95cfe925145c3
SHA157346050388048feb8034d5011b105018483b4a0
SHA256ea9674d42081557b34958b2f7085f8d3865e71660d8f36258fa1c088d90d2398
SHA51282767fdf269f813b5d39bb44c481f01678f9eab332ecc42f11d5a4f00a1970a6dd1875d30a98042113d37b04e501414b33e18abf2ab2a7995e5e773489f9cd82
-
Filesize
8KB
MD523a86b20cf66dfd2d0f47677ed4e4264
SHA1e305170714392447308c804f73458bb9c069ef5a
SHA2563185553519527ae7613eb80e9ead2874b0d7cce0bff2a75bdfad945709dd9043
SHA512933943b152684c5b4aba6d326100fa2d99c56966139ebc4abae690a93bb4dec4fc2229c9f042c979d40d1250006f91424fc9a005659e336df9e9d99a419b8755
-
Filesize
1KB
MD593a100713ff56b66e15f984d3100aab7
SHA14ffb9e5c0d7687a38cc9b9f767bd4b9d4a325656
SHA2560c80edf0d6699061728f917d731ea29e7ad3c7f2ea067d4510a01369255cbd26
SHA512df8b5e56e9dcf0c3e4737e8ab878a4182c757d731f8e893c0285fa5e5d89faec75f4f1f0e8fbf2d502a28632410198ae6dfed82ac5a593d23cf5c2bd59c3c4fc
-
Filesize
12KB
MD5f9f25c79e2df9c8c8209b5d052a557b0
SHA12d4a14e2df96245a599bacb530e396c2900a5b61
SHA256385214231d70603caaf00c1f2e9f115be35cc603d289dd878069f9933aa591b5
SHA5127c9d68d4f96cef25f4703fe4db68fda9689308df759ef05666421c74f0e57b4c25fa8d1c6cf9e5a6a0e9a81d230669b8656279076e60ebfd1ba5b56770fa4ca2
-
Filesize
817KB
MD50a6c58fc386c9a4d7d43b809447f3eac
SHA1b07d0ae1180e21bf79b3b720d9e03e2b7982972d
SHA256d71c0aaec63294fb11af30ff408e94b5fff656149da01e3f7a97e3026580d5c2
SHA512e2d08ae110f30257daa9341d1e3c91d6c50f6b32107d1e1ca0badcce872d09ac3d3a3998f26b1f93c3b1937317ce5ea240652d1b784c5a4d2e30273c19a9b6ad
-
Filesize
817KB
MD50a6c58fc386c9a4d7d43b809447f3eac
SHA1b07d0ae1180e21bf79b3b720d9e03e2b7982972d
SHA256d71c0aaec63294fb11af30ff408e94b5fff656149da01e3f7a97e3026580d5c2
SHA512e2d08ae110f30257daa9341d1e3c91d6c50f6b32107d1e1ca0badcce872d09ac3d3a3998f26b1f93c3b1937317ce5ea240652d1b784c5a4d2e30273c19a9b6ad
-
Filesize
817KB
MD504944752e093ced72012cecb1b2889f7
SHA12c7f25b9350038f36f286a9a8d49ded89260b9ed
SHA2566b778fca7bdee2c754108987ec7c085a4e30c707ac7ac71290c2f2c920bfde25
SHA51249126d797a1ad6c24941744012d22d51bde409914b56b7d631e34cb85e8dc012f34ab61ca1cd9ca675fed868b12a7cb2dc073c4afd3de7a5f9bd3b01cae7bfc9
-
Filesize
1.2MB
-
Filesize
2.7MB
-
Filesize
2.6MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
40.5MB
-
Filesize
932KB
-
Filesize
1.2MB
-
Filesize
40.5MB