Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
17/03/2023, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe
Resource
win10-20230220-en
General
-
Target
eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe
-
Size
3.7MB
-
MD5
e892ba36a0122b457037ba9cc2fa3c1a
-
SHA1
f5f134bef0147d7318337624ea5ea9444cb86936
-
SHA256
eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7
-
SHA512
660df56602c3c26a1395c653adb86a0cd24739a3256c3015fc90bebefcdb376f40199269d88c176936fd5bc8b89738c1227e269b22a1d45a28a72b0cfaedb161
-
SSDEEP
49152:ZkFn+eJtmmiww1udq1aKT5V/OQOt5Z9id3Z:
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key opened \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Key created \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tjetmzrzwfw = "\"C:\\Users\\Admin\\AppData\\Roaming\\Jyrwehu\\Tjetmzrzwfw.exe\"" eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1064 set thread context of 2948 1064 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 69 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2416 powershell.exe 2416 powershell.exe 2416 powershell.exe 2948 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 2948 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 2948 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2416 powershell.exe Token: SeDebugPrivilege 1064 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe Token: SeDebugPrivilege 2948 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1064 wrote to memory of 2416 1064 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 66 PID 1064 wrote to memory of 2416 1064 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 66 PID 1064 wrote to memory of 2948 1064 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 69 PID 1064 wrote to memory of 2948 1064 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 69 PID 1064 wrote to memory of 2948 1064 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 69 PID 1064 wrote to memory of 2948 1064 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 69 PID 1064 wrote to memory of 2948 1064 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 69 PID 1064 wrote to memory of 2948 1064 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe 69 -
outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe -
outlook_win_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe"C:\Users\Admin\AppData\Local\Temp\eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exeC:\Users\Admin\AppData\Local\Temp\eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2948
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe.log
Filesize1KB
MD5fdcb08c3ae39d36273efa7d8f65d96c3
SHA1774860730a9e7211a7435d56f4dda9c0a9da8bf1
SHA256357bf82513fcb1d37b8452e467cb9593379b32f597979e2481d5716b02aff1a6
SHA512b8a911621797c464a26d184049e6df8d4e157c3b3bc004575aa8e7553ecbec3032120b71ef7c7782a3535f538ebe6d25b8b993ce9db0371f9cc524fbfee075ea
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a