Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/04/2023, 19:18

General

  • Target

    8e798b6e766493c894935073db220a3440007f940a78c9f94045de6303fdec2f.exe

  • Size

    1.1MB

  • MD5

    d64edcff5aeff2aec2ee1bdcbd617d07

  • SHA1

    3d3c1ba7c4bfbf4183d9708d1c1e00defa05cf4e

  • SHA256

    8e798b6e766493c894935073db220a3440007f940a78c9f94045de6303fdec2f

  • SHA512

    dda5fc962dd974e94381796e57183a886ce8bcc09c7423b2b41a957cb4c6dbf2febc172cfa5ff87ee553039da41bf43a24b8971d48b13a99e0edd8586b07117e

  • SSDEEP

    24576:cyXV/saQXMbJDMroMrhCXocgtk6mYk2r:LXV/VQXoMUMrhCXocEk6mY9

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e798b6e766493c894935073db220a3440007f940a78c9f94045de6303fdec2f.exe
    "C:\Users\Admin\AppData\Local\Temp\8e798b6e766493c894935073db220a3440007f940a78c9f94045de6303fdec2f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3612
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un945094.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un945094.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4108
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un160677.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un160677.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2072
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr471871.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr471871.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3812
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu024203.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu024203.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2548
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk832667.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk832667.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3204
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si323136.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si323136.exe
      2⤵
      • Executes dropped EXE
      PID:348
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 620
        3⤵
        • Program crash
        PID:984
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 700
        3⤵
        • Program crash
        PID:4756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 840
        3⤵
        • Program crash
        PID:3528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 880
        3⤵
        • Program crash
        PID:4796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 884
        3⤵
        • Program crash
        PID:2872
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 888
        3⤵
        • Program crash
        PID:2760
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 1076
        3⤵
        • Program crash
        PID:1308

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si323136.exe

    Filesize

    381KB

    MD5

    f1cada3622a5d7ac8bd7c511639ccea9

    SHA1

    6c63f5857c1ef1d6f8ff76a9109b77846170266a

    SHA256

    8127bc9f82467eca7c5d2360ebd6d4e275d341a1a254da42e088e78b24ad2655

    SHA512

    7e3a4a960aa74316f0648b041b4885e1f417cb366a7d79f571e3cee50eb7f4bcfe7dcd44be82d3da222ab91f196bbfb2efa677fcb98d17908e17b25c7cfdc30c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si323136.exe

    Filesize

    381KB

    MD5

    f1cada3622a5d7ac8bd7c511639ccea9

    SHA1

    6c63f5857c1ef1d6f8ff76a9109b77846170266a

    SHA256

    8127bc9f82467eca7c5d2360ebd6d4e275d341a1a254da42e088e78b24ad2655

    SHA512

    7e3a4a960aa74316f0648b041b4885e1f417cb366a7d79f571e3cee50eb7f4bcfe7dcd44be82d3da222ab91f196bbfb2efa677fcb98d17908e17b25c7cfdc30c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un945094.exe

    Filesize

    763KB

    MD5

    28e4841feff20fe8898b04370041f270

    SHA1

    625910424d3b56a475c5cebd102c41727ec1b5c4

    SHA256

    786ad480f3ad31f253864e61af7ecbc14a8fbaca9e5fbd82c1d1236681f04f19

    SHA512

    40b48d3b8935689dae0bbe0eb201252beb22eddc73e5ea8a90ab4633a079359a92f8ffca0de44b89b17fa613ee6649710ab77d44eb38fdf100c785ce46da9e78

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un945094.exe

    Filesize

    763KB

    MD5

    28e4841feff20fe8898b04370041f270

    SHA1

    625910424d3b56a475c5cebd102c41727ec1b5c4

    SHA256

    786ad480f3ad31f253864e61af7ecbc14a8fbaca9e5fbd82c1d1236681f04f19

    SHA512

    40b48d3b8935689dae0bbe0eb201252beb22eddc73e5ea8a90ab4633a079359a92f8ffca0de44b89b17fa613ee6649710ab77d44eb38fdf100c785ce46da9e78

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk832667.exe

    Filesize

    136KB

    MD5

    86810f340795831f3c2bd147981be929

    SHA1

    573345e2c322720fa43f74d761ff1d48028f36c9

    SHA256

    d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

    SHA512

    c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk832667.exe

    Filesize

    136KB

    MD5

    86810f340795831f3c2bd147981be929

    SHA1

    573345e2c322720fa43f74d761ff1d48028f36c9

    SHA256

    d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

    SHA512

    c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un160677.exe

    Filesize

    609KB

    MD5

    4b843ced5338be9c1e732d525dc496d7

    SHA1

    ab3b1ee1bceb44856b35e7a89aa914ea408c6fbd

    SHA256

    7d2be463e5499de2966d9d8585f94f99c5c2c4a39946992c7eac44adb05517c2

    SHA512

    4c1ad80a556dd0f5340cc402df29f23e9725caf5b10548ffd8e2561d026000f0b9eb8ace3690d11529e919627eefdda8ba2f64946375d323fe89246986936e14

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un160677.exe

    Filesize

    609KB

    MD5

    4b843ced5338be9c1e732d525dc496d7

    SHA1

    ab3b1ee1bceb44856b35e7a89aa914ea408c6fbd

    SHA256

    7d2be463e5499de2966d9d8585f94f99c5c2c4a39946992c7eac44adb05517c2

    SHA512

    4c1ad80a556dd0f5340cc402df29f23e9725caf5b10548ffd8e2561d026000f0b9eb8ace3690d11529e919627eefdda8ba2f64946375d323fe89246986936e14

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr471871.exe

    Filesize

    403KB

    MD5

    25a18f0193a33f31988bcbc763b79e20

    SHA1

    12958812f51f9d370031bcf51b8002b2b14019d2

    SHA256

    61fc5ac4e966aab5dc63c208c78bb9ce9e7ac2f9dad4a5ba8ed7bfa40fec6edd

    SHA512

    f62343733a3c0e0140e2639667df3002f3aa7435c6a3f1a75d7ca8fc36e0f964d5e3fd9d492f474da85d22a490e5abf36349d8ec30bbaa97ef20b67400ff069e

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr471871.exe

    Filesize

    403KB

    MD5

    25a18f0193a33f31988bcbc763b79e20

    SHA1

    12958812f51f9d370031bcf51b8002b2b14019d2

    SHA256

    61fc5ac4e966aab5dc63c208c78bb9ce9e7ac2f9dad4a5ba8ed7bfa40fec6edd

    SHA512

    f62343733a3c0e0140e2639667df3002f3aa7435c6a3f1a75d7ca8fc36e0f964d5e3fd9d492f474da85d22a490e5abf36349d8ec30bbaa97ef20b67400ff069e

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu024203.exe

    Filesize

    485KB

    MD5

    6581191b8da937c1246fb24dc8f24149

    SHA1

    5787c94c5d56fc8c04b81b3a2ca175c99f18cce6

    SHA256

    d3bbcfa524244e7a5a98becc6388691728ddbb030966f50e26d4c54c81ae3149

    SHA512

    5e6d22fbece6836dd935f9755c8dd849b9a677bb014d635a957f0e834beb2d933496dede99dcf98b3944006f708b0a6382943bc50b76ec482c57d3009186bd25

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu024203.exe

    Filesize

    485KB

    MD5

    6581191b8da937c1246fb24dc8f24149

    SHA1

    5787c94c5d56fc8c04b81b3a2ca175c99f18cce6

    SHA256

    d3bbcfa524244e7a5a98becc6388691728ddbb030966f50e26d4c54c81ae3149

    SHA512

    5e6d22fbece6836dd935f9755c8dd849b9a677bb014d635a957f0e834beb2d933496dede99dcf98b3944006f708b0a6382943bc50b76ec482c57d3009186bd25

  • memory/348-1004-0x00000000008E0000-0x0000000000915000-memory.dmp

    Filesize

    212KB

  • memory/2548-979-0x0000000007870000-0x0000000007882000-memory.dmp

    Filesize

    72KB

  • memory/2548-981-0x00000000079A0000-0x00000000079DE000-memory.dmp

    Filesize

    248KB

  • memory/2548-990-0x0000000009010000-0x000000000953C000-memory.dmp

    Filesize

    5.2MB

  • memory/2548-989-0x0000000008E40000-0x0000000009002000-memory.dmp

    Filesize

    1.8MB

  • memory/2548-988-0x0000000008DD0000-0x0000000008E20000-memory.dmp

    Filesize

    320KB

  • memory/2548-987-0x0000000008BF0000-0x0000000008C0E000-memory.dmp

    Filesize

    120KB

  • memory/2548-986-0x0000000008B20000-0x0000000008B96000-memory.dmp

    Filesize

    472KB

  • memory/2548-985-0x0000000008980000-0x0000000008A12000-memory.dmp

    Filesize

    584KB

  • memory/2548-984-0x0000000007CB0000-0x0000000007D16000-memory.dmp

    Filesize

    408KB

  • memory/2548-983-0x0000000007A20000-0x0000000007A6B000-memory.dmp

    Filesize

    300KB

  • memory/2548-982-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

    Filesize

    64KB

  • memory/2548-980-0x0000000007890000-0x000000000799A000-memory.dmp

    Filesize

    1.0MB

  • memory/2548-978-0x0000000007DF0000-0x00000000083F6000-memory.dmp

    Filesize

    6.0MB

  • memory/2548-219-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-217-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-215-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-213-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-211-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-209-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-180-0x0000000002690000-0x00000000026CC000-memory.dmp

    Filesize

    240KB

  • memory/2548-181-0x00000000052E0000-0x000000000531A000-memory.dmp

    Filesize

    232KB

  • memory/2548-183-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-182-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-185-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-187-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-189-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-191-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-193-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-195-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-197-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-198-0x0000000000820000-0x0000000000866000-memory.dmp

    Filesize

    280KB

  • memory/2548-200-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

    Filesize

    64KB

  • memory/2548-202-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

    Filesize

    64KB

  • memory/2548-204-0x0000000004DD0000-0x0000000004DE0000-memory.dmp

    Filesize

    64KB

  • memory/2548-205-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-201-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/2548-207-0x00000000052E0000-0x0000000005315000-memory.dmp

    Filesize

    212KB

  • memory/3204-996-0x0000000000310000-0x0000000000338000-memory.dmp

    Filesize

    160KB

  • memory/3204-998-0x0000000007370000-0x0000000007380000-memory.dmp

    Filesize

    64KB

  • memory/3204-997-0x0000000007090000-0x00000000070DB000-memory.dmp

    Filesize

    300KB

  • memory/3812-163-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-159-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-171-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3812-170-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3812-143-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-169-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-149-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-167-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-165-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-145-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-161-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-172-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3812-157-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-155-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-153-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-151-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-142-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-141-0x00000000027E0000-0x00000000027F8000-memory.dmp

    Filesize

    96KB

  • memory/3812-173-0x0000000000400000-0x000000000080A000-memory.dmp

    Filesize

    4.0MB

  • memory/3812-175-0x0000000000400000-0x000000000080A000-memory.dmp

    Filesize

    4.0MB

  • memory/3812-147-0x00000000027E0000-0x00000000027F2000-memory.dmp

    Filesize

    72KB

  • memory/3812-140-0x0000000004F10000-0x000000000540E000-memory.dmp

    Filesize

    5.0MB

  • memory/3812-139-0x00000000022E0000-0x00000000022FA000-memory.dmp

    Filesize

    104KB

  • memory/3812-138-0x00000000008E0000-0x000000000090D000-memory.dmp

    Filesize

    180KB