Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17/03/2023, 08:32

General

  • Target

    eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe

  • Size

    3.7MB

  • MD5

    e892ba36a0122b457037ba9cc2fa3c1a

  • SHA1

    f5f134bef0147d7318337624ea5ea9444cb86936

  • SHA256

    eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7

  • SHA512

    660df56602c3c26a1395c653adb86a0cd24739a3256c3015fc90bebefcdb376f40199269d88c176936fd5bc8b89738c1227e269b22a1d45a28a72b0cfaedb161

  • SSDEEP

    49152:ZkFn+eJtmmiww1udq1aKT5V/OQOt5Z9id3Z:

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe
    "C:\Users\Admin\AppData\Local\Temp\eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2416
    • C:\Users\Admin\AppData\Local\Temp\eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe
      C:\Users\Admin\AppData\Local\Temp\eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2948

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\eb80c9d327ffd6ede1d2b0558572de31384c0cbbd8520fd3093ffb5266f7fae7.exe.log

    Filesize

    1KB

    MD5

    fdcb08c3ae39d36273efa7d8f65d96c3

    SHA1

    774860730a9e7211a7435d56f4dda9c0a9da8bf1

    SHA256

    357bf82513fcb1d37b8452e467cb9593379b32f597979e2481d5716b02aff1a6

    SHA512

    b8a911621797c464a26d184049e6df8d4e157c3b3bc004575aa8e7553ecbec3032120b71ef7c7782a3535f538ebe6d25b8b993ce9db0371f9cc524fbfee075ea

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5fvsowea.spg.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • memory/1064-118-0x000001665DF30000-0x000001665E2EE000-memory.dmp

    Filesize

    3.7MB

  • memory/1064-119-0x00000166788C0000-0x0000016678AC0000-memory.dmp

    Filesize

    2.0MB

  • memory/1064-120-0x000001665FF80000-0x0000016660012000-memory.dmp

    Filesize

    584KB

  • memory/1064-121-0x0000016678730000-0x0000016678752000-memory.dmp

    Filesize

    136KB

  • memory/1064-122-0x00000166788B0000-0x00000166788C0000-memory.dmp

    Filesize

    64KB

  • memory/1064-149-0x00000166788B0000-0x00000166788C0000-memory.dmp

    Filesize

    64KB

  • memory/2416-132-0x0000022C73810000-0x0000022C73886000-memory.dmp

    Filesize

    472KB

  • memory/2416-141-0x0000022C71430000-0x0000022C71440000-memory.dmp

    Filesize

    64KB

  • memory/2416-144-0x0000022C71430000-0x0000022C71440000-memory.dmp

    Filesize

    64KB

  • memory/2416-150-0x0000022C71430000-0x0000022C71440000-memory.dmp

    Filesize

    64KB

  • memory/2416-151-0x0000022C71430000-0x0000022C71440000-memory.dmp

    Filesize

    64KB

  • memory/2948-156-0x0000000000400000-0x00000000004C6000-memory.dmp

    Filesize

    792KB

  • memory/2948-159-0x00000157FAC50000-0x00000157FAD4C000-memory.dmp

    Filesize

    1008KB

  • memory/2948-160-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-161-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-163-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-165-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-167-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-169-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-171-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-173-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-175-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-177-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-179-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-181-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-183-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-186-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-185-0x00000157FA340000-0x00000157FA350000-memory.dmp

    Filesize

    64KB

  • memory/2948-188-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-190-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-192-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-194-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-196-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-198-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-200-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-202-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-204-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-206-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-210-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-214-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-212-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-216-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-208-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-218-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-222-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-220-0x00000157FAC50000-0x00000157FAD48000-memory.dmp

    Filesize

    992KB

  • memory/2948-1549-0x00000157FA340000-0x00000157FA350000-memory.dmp

    Filesize

    64KB

  • memory/2948-2492-0x00000157FAD50000-0x00000157FADC2000-memory.dmp

    Filesize

    456KB

  • memory/2948-2493-0x00000157FADC0000-0x00000157FAE30000-memory.dmp

    Filesize

    448KB

  • memory/2948-2494-0x00000157FA340000-0x00000157FA350000-memory.dmp

    Filesize

    64KB

  • memory/2948-2495-0x00000157FA340000-0x00000157FA350000-memory.dmp

    Filesize

    64KB

  • memory/2948-2496-0x00000157FAF30000-0x00000157FAF7C000-memory.dmp

    Filesize

    304KB

  • memory/2948-2497-0x00000157FA260000-0x00000157FA280000-memory.dmp

    Filesize

    128KB

  • memory/2948-2498-0x00000157FA340000-0x00000157FA350000-memory.dmp

    Filesize

    64KB

  • memory/2948-2517-0x00000157FB8D0000-0x00000157FB94A000-memory.dmp

    Filesize

    488KB

  • memory/2948-2526-0x00000157FA340000-0x00000157FA350000-memory.dmp

    Filesize

    64KB

  • memory/2948-2527-0x00000157FA340000-0x00000157FA350000-memory.dmp

    Filesize

    64KB