Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    99s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2023, 21:30

General

  • Target

    0c03276ca27012cd6a8889664e261b98da41b0f80f587db4b3d97ad6a76690cc.exe

  • Size

    291KB

  • MD5

    ac83657f02dff63c790b80a66ad3d4e3

  • SHA1

    7e9a2f828a38ad058bd619137f66266ddc664c3a

  • SHA256

    0c03276ca27012cd6a8889664e261b98da41b0f80f587db4b3d97ad6a76690cc

  • SHA512

    4cc2bcde052072b91cb08bb3b56c4a9249d07d60e4a12512dd1569a4d26a8aa23a0cef909eef90557f1e2bd958034d38970823ef9934e754d97f34d49c98328f

  • SSDEEP

    6144:mLsYcKYVe7xZCptofhwqkasx0XBvnZWf0G4EThJfh:m4YcVe7xE3zvae0RvnZWfhJJ

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c03276ca27012cd6a8889664e261b98da41b0f80f587db4b3d97ad6a76690cc.exe
    "C:\Users\Admin\AppData\Local\Temp\0c03276ca27012cd6a8889664e261b98da41b0f80f587db4b3d97ad6a76690cc.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:376
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 1388
      2⤵
      • Program crash
      PID:5084
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 376 -ip 376
    1⤵
      PID:1624

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/376-132-0x0000000004EF0000-0x0000000005494000-memory.dmp

      Filesize

      5.6MB

    • memory/376-133-0x000000000094E000-0x000000000097C000-memory.dmp

      Filesize

      184KB

    • memory/376-134-0x00000000024D0000-0x000000000251B000-memory.dmp

      Filesize

      300KB

    • memory/376-135-0x0000000000400000-0x0000000000766000-memory.dmp

      Filesize

      3.4MB

    • memory/376-136-0x00000000054A0000-0x0000000005AB8000-memory.dmp

      Filesize

      6.1MB

    • memory/376-137-0x0000000005B40000-0x0000000005C4A000-memory.dmp

      Filesize

      1.0MB

    • memory/376-138-0x0000000005C80000-0x0000000005C92000-memory.dmp

      Filesize

      72KB

    • memory/376-139-0x0000000005CA0000-0x0000000005CDC000-memory.dmp

      Filesize

      240KB

    • memory/376-140-0x0000000005F90000-0x0000000006022000-memory.dmp

      Filesize

      584KB

    • memory/376-141-0x0000000006030000-0x0000000006096000-memory.dmp

      Filesize

      408KB

    • memory/376-142-0x000000000094E000-0x000000000097C000-memory.dmp

      Filesize

      184KB

    • memory/376-143-0x0000000006980000-0x0000000006B42000-memory.dmp

      Filesize

      1.8MB

    • memory/376-144-0x0000000006BA0000-0x00000000070CC000-memory.dmp

      Filesize

      5.2MB

    • memory/376-145-0x0000000007510000-0x0000000007586000-memory.dmp

      Filesize

      472KB

    • memory/376-146-0x00000000075A0000-0x00000000075F0000-memory.dmp

      Filesize

      320KB

    • memory/376-147-0x0000000000400000-0x0000000000766000-memory.dmp

      Filesize

      3.4MB