Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2023, 23:50

General

  • Target

    3d690f5186610aa0af9248cb1738040a970b723f981e280ce72b3b8ad0b2510b.exe

  • Size

    1.1MB

  • MD5

    d8ceadba06f9a692253dec6cd54d6530

  • SHA1

    c2da9d6704513d9723365cf19872b32213e815f6

  • SHA256

    3d690f5186610aa0af9248cb1738040a970b723f981e280ce72b3b8ad0b2510b

  • SHA512

    3ee5253eeb7f08ac3109832a02de0e0db21191ee829b2e65a9053bb99a95e1c643f7dc78191f8f9d54154e1b66a42a894adbdaca8cce930a5bad46a294662855

  • SSDEEP

    24576:x0h5V9e6+l15/y8VMBMSk7lXJxCkKzrYOOTqT+UVX0eHEeGJifZ9:xc8/y0lRCkKHYXW+UVXzHEe

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 64 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d690f5186610aa0af9248cb1738040a970b723f981e280ce72b3b8ad0b2510b.exe
    "C:\Users\Admin\AppData\Local\Temp\3d690f5186610aa0af9248cb1738040a970b723f981e280ce72b3b8ad0b2510b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3856
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp",Uuhpdwiyer
      2⤵
      • Blocklisted process makes network request
      • Sets DLL path for service in the registry
      • Sets service image path in registry
      • Loads dropped DLL
      • Accesses Microsoft Outlook accounts
      • Accesses Microsoft Outlook profiles
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:1488
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 17209
        3⤵
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:3620
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
        3⤵
          PID:2120
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
          3⤵
            PID:1252
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
            3⤵
              PID:4628
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
              3⤵
                PID:4660
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
                3⤵
                  PID:4872
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
                  3⤵
                    PID:4532
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 556
                  2⤵
                  • Program crash
                  PID:1496
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3856 -ip 3856
                1⤵
                  PID:4648
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  1⤵
                    PID:4940
                  • C:\Windows\SysWOW64\svchost.exe
                    C:\Windows\SysWOW64\svchost.exe -k LocalService
                    1⤵
                    • Loads dropped DLL
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4676
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows nt\tabletextservice\ccloud.dll",SSInS3FR
                      2⤵
                      • Loads dropped DLL
                      • Checks processor information in registry
                      PID:4820

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files (x86)\Windows NT\TableTextService\ccloud.dll

                    Filesize

                    805KB

                    MD5

                    b9037084f0da58087fd8f3f9f9174cc2

                    SHA1

                    af53475d008ce16ab506320f0d2ded9d458face8

                    SHA256

                    c6e26e5cbb4b150046cb802e10f74a9501f73d1e9dcc893a33d16d69c8e2cebf

                    SHA512

                    bd4bb67622a09cdd75ec9dfdcaa95756424d78ce64c6e904d3fbf5bf0836e67cf8188fe1bed7e86fdd94fd40813b1ac39a6e12e0634e81212b80d9a3a8783d26

                  • C:\Program Files (x86)\Windows NT\TableTextService\ccloud.dll

                    Filesize

                    805KB

                    MD5

                    b9037084f0da58087fd8f3f9f9174cc2

                    SHA1

                    af53475d008ce16ab506320f0d2ded9d458face8

                    SHA256

                    c6e26e5cbb4b150046cb802e10f74a9501f73d1e9dcc893a33d16d69c8e2cebf

                    SHA512

                    bd4bb67622a09cdd75ec9dfdcaa95756424d78ce64c6e904d3fbf5bf0836e67cf8188fe1bed7e86fdd94fd40813b1ac39a6e12e0634e81212b80d9a3a8783d26

                  • C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe.xml

                    Filesize

                    22KB

                    MD5

                    e0deca52ec488a29758550b78fa3b719

                    SHA1

                    188ae9939a0875f11a611ee7d8604c7a348bc0d2

                    SHA256

                    9337e81fdc5c57705e3c587ce9bf99bc176e127acd2539eb6a18c3a6c2b87816

                    SHA512

                    ce84157a418fa8b2d5b576da37796b323b8d2a5e8af6e9651c23ecfb1a32dc0f65872d2919f148c5deaed4acd5b4336767fd949fd98ab2aafbf36abaeca863f3

                  • C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe.xml

                    Filesize

                    843B

                    MD5

                    8a33c96712ba9c043f7a07d4c437a3fd

                    SHA1

                    dbd78a66c461017ee26a751925f9cecdea2590da

                    SHA256

                    eb8b0de59dd2efc380f7081af8975f37a83ee72c9c06ef25873f63d224adea1e

                    SHA512

                    7b9a15d219e4a5cd9146f8e7ae1d7c3b6f843ed060edf52e4928e349edd821a2d527f8f8402f774559f6cf282c83b751f02d2feaf9e040771c07bc4038a59e5a

                  • C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\Peqquspi.tmp

                    Filesize

                    3.5MB

                    MD5

                    1f3a74c588c48aed8adbc2bf1cf939a2

                    SHA1

                    56b5597568b00e51b9b8be69db48189ce8214aeb

                    SHA256

                    8834852390c3cc4b8658e8d758370ead462c762f03f978739c6896c6e6ededf5

                    SHA512

                    90b35832027e725a36faf61dc79b3a1b77b5c15eb7bf32ba178afd7ac38b738beb4021f5ca3aa051158848a964aad7dff9492bb4afb12d8bd40751ec878a7d1c

                  • C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\print_property.ico

                    Filesize

                    58KB

                    MD5

                    30d7062e069bc0a9b34f4034090c1aae

                    SHA1

                    e5fcedd8e4cc0463c0bc6912b1791f2876e28a61

                    SHA256

                    24e77f244b0743e311b0fc97f06513a0cecf6560e92f9c6f164288a152d32000

                    SHA512

                    85dd6c916d48804a24dbbad0f4b4842453ac31a692905f8f2f34112eaa1bbf062a825d45ed5d800bbc4663a28b0b5003ebd5fa54991cf846f1028e929ea06de6

                  • C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\resource.xml

                    Filesize

                    1KB

                    MD5

                    0e190f6bbc7898c31d4eae77c6abebfe

                    SHA1

                    fb6673c8116b650f0536d56be09eb188d7bdc930

                    SHA256

                    f7f461d92f4a45d1232e7e5ad76cffbbb7b83abd69df864387c757051494d118

                    SHA512

                    faaf0699ddb7e4e152afaf54bed0794c9e816cb762454c277f5d52acf88a44535cc3a44797c73393fc50db8afe2566bcaf9a4f93d945c6b0b3d8458d16ae5312

                  • C:\ProgramData\{D0B46527-7C45-A967-1A4D-5BBD0FF57755}\user.bmp

                    Filesize

                    588KB

                    MD5

                    908fa2dfb385771ecf5f8b2b3e7bff16

                    SHA1

                    1255fa1edbd2dbbcab6d9eb9f74b7d6783697a58

                    SHA256

                    60ff5131dba68a8ffe7ba0475bf3e192b432e1969e5ac52d7f217f6935f4035d

                    SHA512

                    573c9fde441fb8debaa44b6fa2d3763c3dc4714497089b82bedc8ef0720eea4a907f75cffb1c0ec4a77ac89cfecbef8e6182a2a8fea5b51a2e91920ceaad5f69

                  • C:\Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp

                    Filesize

                    805KB

                    MD5

                    44d724c9ad9ae3149d4997852eea3e96

                    SHA1

                    dcd92e1b704b3f25ba455e079004c5a5aaf903f9

                    SHA256

                    c5cd7d52ba95127c18556a2ddca64e4ef80a2945e6579545c0067abdab3a0ad0

                    SHA512

                    791c3b62685a475799a991b2f0f9535781c888d48d1dd47b5b2cd407ff46e15231247f07ceb63c012bd923bf88fffaecf29030186e3d569b9886048881012e44

                  • C:\Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp

                    Filesize

                    805KB

                    MD5

                    44d724c9ad9ae3149d4997852eea3e96

                    SHA1

                    dcd92e1b704b3f25ba455e079004c5a5aaf903f9

                    SHA256

                    c5cd7d52ba95127c18556a2ddca64e4ef80a2945e6579545c0067abdab3a0ad0

                    SHA512

                    791c3b62685a475799a991b2f0f9535781c888d48d1dd47b5b2cd407ff46e15231247f07ceb63c012bd923bf88fffaecf29030186e3d569b9886048881012e44

                  • \??\c:\program files (x86)\windows nt\tabletextservice\ccloud.dll

                    Filesize

                    805KB

                    MD5

                    b9037084f0da58087fd8f3f9f9174cc2

                    SHA1

                    af53475d008ce16ab506320f0d2ded9d458face8

                    SHA256

                    c6e26e5cbb4b150046cb802e10f74a9501f73d1e9dcc893a33d16d69c8e2cebf

                    SHA512

                    bd4bb67622a09cdd75ec9dfdcaa95756424d78ce64c6e904d3fbf5bf0836e67cf8188fe1bed7e86fdd94fd40813b1ac39a6e12e0634e81212b80d9a3a8783d26

                  • memory/1488-142-0x0000000005C60000-0x0000000005DA0000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1488-140-0x0000000005C60000-0x0000000005DA0000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1488-145-0x0000000005C60000-0x0000000005DA0000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1488-138-0x0000000004FB0000-0x0000000005ADF000-memory.dmp

                    Filesize

                    11.2MB

                  • memory/1488-139-0x0000000004FB0000-0x0000000005ADF000-memory.dmp

                    Filesize

                    11.2MB

                  • memory/1488-149-0x0000000005CD9000-0x0000000005CDB000-memory.dmp

                    Filesize

                    8KB

                  • memory/1488-141-0x0000000005C60000-0x0000000005DA0000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1488-152-0x0000000004FB0000-0x0000000005ADF000-memory.dmp

                    Filesize

                    11.2MB

                  • memory/1488-144-0x0000000005C60000-0x0000000005DA0000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1488-143-0x0000000005C60000-0x0000000005DA0000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/3620-150-0x0000000000CE0000-0x0000000000F78000-memory.dmp

                    Filesize

                    2.6MB

                  • memory/3620-151-0x000002187A150000-0x000002187A3F9000-memory.dmp

                    Filesize

                    2.7MB

                  • memory/3620-147-0x000002187BA10000-0x000002187BB50000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/3620-148-0x000002187BA10000-0x000002187BB50000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/3856-135-0x00000000022FC000-0x00000000023E0000-memory.dmp

                    Filesize

                    912KB

                  • memory/3856-137-0x0000000000400000-0x0000000000525000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/3856-136-0x00000000023F0000-0x0000000002514000-memory.dmp

                    Filesize

                    1.1MB

                  • memory/4676-169-0x00000000043D0000-0x0000000004EFF000-memory.dmp

                    Filesize

                    11.2MB

                  • memory/4676-156-0x00000000043D0000-0x0000000004EFF000-memory.dmp

                    Filesize

                    11.2MB

                  • memory/4676-157-0x00000000043D0000-0x0000000004EFF000-memory.dmp

                    Filesize

                    11.2MB

                  • memory/4820-165-0x0000000004D50000-0x000000000587F000-memory.dmp

                    Filesize

                    11.2MB

                  • memory/4820-166-0x0000000004D50000-0x000000000587F000-memory.dmp

                    Filesize

                    11.2MB