Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19/04/2023, 17:05

General

  • Target

    2e98b642c968557ef1f7d0d544c4d50238ea8d251d9a9d786f093536cd3e0b74.exe

  • Size

    827KB

  • MD5

    eca74fed67c404f91b6677140e56b459

  • SHA1

    be459c95281dd0b78f7b35b37505ca025c35e644

  • SHA256

    2e98b642c968557ef1f7d0d544c4d50238ea8d251d9a9d786f093536cd3e0b74

  • SHA512

    5875d3f167b51ed3b2d46ca23fd5ef7b350044dad707658a39104acb8f9967b7c151774d7209cf25b3a307b819a59ce3d813a332049f9df608b61a8a8d6e1ffc

  • SSDEEP

    12288:Ly90/LgJoVrcbkK1jgkAUPe/DvJ7cacfQwZ6CwjKjhqBbL:LyymoVoIQjvAUPW17cl4wEljuqBbL

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e98b642c968557ef1f7d0d544c4d50238ea8d251d9a9d786f093536cd3e0b74.exe
    "C:\Users\Admin\AppData\Local\Temp\2e98b642c968557ef1f7d0d544c4d50238ea8d251d9a9d786f093536cd3e0b74.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziry7735.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziry7735.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3268
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDn7386.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDn7386.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it977421.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it977421.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3432
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr344205.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr344205.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4180
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp726064.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp726064.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2216
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr899983.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr899983.exe
      2⤵
      • Executes dropped EXE
      PID:2512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 212
        3⤵
        • Program crash
        PID:2940
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 696
        3⤵
        • Program crash
        PID:4064
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 768
        3⤵
        • Program crash
        PID:2592
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 844
        3⤵
        • Program crash
        PID:3424
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 872
        3⤵
        • Program crash
        PID:4948
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 892
        3⤵
        • Program crash
        PID:1704
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1080
        3⤵
        • Program crash
        PID:4008

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr899983.exe

    Filesize

    255KB

    MD5

    dc97786ccf6b509fa354e925d4494ba8

    SHA1

    f9de77afa22cfe23836b3f0762eb2e33340c6e7c

    SHA256

    4ba0b96c612eb0ce414699667ef729213213a95695e80dbdca7d5f46863ecccd

    SHA512

    69f884157d323352de4af5f2b5e01593125e76aef0e775777da61d4eddb4e62c81a7f00174c4da289a0c03c5e7b1cb06b8013137a6545193bd99087cf46cbd04

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr899983.exe

    Filesize

    255KB

    MD5

    dc97786ccf6b509fa354e925d4494ba8

    SHA1

    f9de77afa22cfe23836b3f0762eb2e33340c6e7c

    SHA256

    4ba0b96c612eb0ce414699667ef729213213a95695e80dbdca7d5f46863ecccd

    SHA512

    69f884157d323352de4af5f2b5e01593125e76aef0e775777da61d4eddb4e62c81a7f00174c4da289a0c03c5e7b1cb06b8013137a6545193bd99087cf46cbd04

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziry7735.exe

    Filesize

    568KB

    MD5

    fc2ec75382e36e0c4cb1374b123b53c4

    SHA1

    7115d43f7bf16af64733c604202080ee20ff84c0

    SHA256

    a81945181aa46d3b55be44b12e4a0d4d0a4c015bdaeb7b4cf45de6887e606547

    SHA512

    b9a2e90188d4a5236008a8ab5d38ee0efdb66d26b527d8e484ecf5ab8edbef212d1eb428d7f791515a787b6d021242fba87c75732e6f80c627236b189ee9171a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziry7735.exe

    Filesize

    568KB

    MD5

    fc2ec75382e36e0c4cb1374b123b53c4

    SHA1

    7115d43f7bf16af64733c604202080ee20ff84c0

    SHA256

    a81945181aa46d3b55be44b12e4a0d4d0a4c015bdaeb7b4cf45de6887e606547

    SHA512

    b9a2e90188d4a5236008a8ab5d38ee0efdb66d26b527d8e484ecf5ab8edbef212d1eb428d7f791515a787b6d021242fba87c75732e6f80c627236b189ee9171a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp726064.exe

    Filesize

    136KB

    MD5

    86810f340795831f3c2bd147981be929

    SHA1

    573345e2c322720fa43f74d761ff1d48028f36c9

    SHA256

    d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

    SHA512

    c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp726064.exe

    Filesize

    136KB

    MD5

    86810f340795831f3c2bd147981be929

    SHA1

    573345e2c322720fa43f74d761ff1d48028f36c9

    SHA256

    d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

    SHA512

    c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDn7386.exe

    Filesize

    414KB

    MD5

    9317fcba0608d5c2f305de9571624a8f

    SHA1

    3a4049c334f00d586c8ac7c6f831de85d3ceac3a

    SHA256

    a5726ccbcb0e34c5fcd4c04da4bd71123feb3c479c7b32ab97e56797b560ea98

    SHA512

    40c9956ce171dbf1a603cbb62b2992679796b252fd51a072c0c96aee838e74aca12fc7f56d1b9859602edaec8c3ab9f8d04366f7ee2ee60df2322335c3e58469

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziDn7386.exe

    Filesize

    414KB

    MD5

    9317fcba0608d5c2f305de9571624a8f

    SHA1

    3a4049c334f00d586c8ac7c6f831de85d3ceac3a

    SHA256

    a5726ccbcb0e34c5fcd4c04da4bd71123feb3c479c7b32ab97e56797b560ea98

    SHA512

    40c9956ce171dbf1a603cbb62b2992679796b252fd51a072c0c96aee838e74aca12fc7f56d1b9859602edaec8c3ab9f8d04366f7ee2ee60df2322335c3e58469

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it977421.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it977421.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr344205.exe

    Filesize

    359KB

    MD5

    34ec028ae2db163bc43f8035350c4f5d

    SHA1

    3167f6654c514a8b4f1049860669a6061532579d

    SHA256

    3526b898171aa116909343b6aa1ad90cd5386c95322b22ae678a0e3ebd15396d

    SHA512

    0d3c88bd03a6ad57da7c554403d5a0268edd1d3d10e79790157bf279a66e47bbf1e538187daf7b9b849449290868930d5dc35c106ceaa6959029a998475f1a74

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr344205.exe

    Filesize

    359KB

    MD5

    34ec028ae2db163bc43f8035350c4f5d

    SHA1

    3167f6654c514a8b4f1049860669a6061532579d

    SHA256

    3526b898171aa116909343b6aa1ad90cd5386c95322b22ae678a0e3ebd15396d

    SHA512

    0d3c88bd03a6ad57da7c554403d5a0268edd1d3d10e79790157bf279a66e47bbf1e538187daf7b9b849449290868930d5dc35c106ceaa6959029a998475f1a74

  • memory/2216-970-0x0000000007230000-0x000000000727B000-memory.dmp

    Filesize

    300KB

  • memory/2216-969-0x00000000004B0000-0x00000000004D8000-memory.dmp

    Filesize

    160KB

  • memory/2216-971-0x0000000007280000-0x0000000007290000-memory.dmp

    Filesize

    64KB

  • memory/2512-977-0x0000000002BA0000-0x0000000002BD5000-memory.dmp

    Filesize

    212KB

  • memory/3432-142-0x0000000000CA0000-0x0000000000CAA000-memory.dmp

    Filesize

    40KB

  • memory/4180-186-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-202-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-154-0x00000000072B0000-0x00000000072C0000-memory.dmp

    Filesize

    64KB

  • memory/4180-155-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-156-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-158-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-160-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-162-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-164-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-166-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-168-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-170-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-172-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-174-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-176-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-178-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-180-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-182-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-184-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-153-0x00000000072B0000-0x00000000072C0000-memory.dmp

    Filesize

    64KB

  • memory/4180-188-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-190-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-192-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-194-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-196-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-198-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-200-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-152-0x00000000072B0000-0x00000000072C0000-memory.dmp

    Filesize

    64KB

  • memory/4180-204-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-206-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-208-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-210-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-212-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-214-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-216-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-218-0x0000000007150000-0x0000000007185000-memory.dmp

    Filesize

    212KB

  • memory/4180-947-0x0000000009C40000-0x000000000A246000-memory.dmp

    Filesize

    6.0MB

  • memory/4180-948-0x0000000007260000-0x0000000007272000-memory.dmp

    Filesize

    72KB

  • memory/4180-949-0x000000000A250000-0x000000000A35A000-memory.dmp

    Filesize

    1.0MB

  • memory/4180-950-0x00000000072B0000-0x00000000072C0000-memory.dmp

    Filesize

    64KB

  • memory/4180-951-0x000000000A360000-0x000000000A39E000-memory.dmp

    Filesize

    248KB

  • memory/4180-952-0x000000000A3D0000-0x000000000A41B000-memory.dmp

    Filesize

    300KB

  • memory/4180-953-0x000000000A660000-0x000000000A6C6000-memory.dmp

    Filesize

    408KB

  • memory/4180-954-0x000000000AD10000-0x000000000ADA2000-memory.dmp

    Filesize

    584KB

  • memory/4180-955-0x000000000AEF0000-0x000000000AF40000-memory.dmp

    Filesize

    320KB

  • memory/4180-956-0x000000000AF40000-0x000000000AFB6000-memory.dmp

    Filesize

    472KB

  • memory/4180-957-0x000000000AFD0000-0x000000000AFEE000-memory.dmp

    Filesize

    120KB

  • memory/4180-958-0x000000000B0A0000-0x000000000B262000-memory.dmp

    Filesize

    1.8MB

  • memory/4180-151-0x0000000007150000-0x000000000718A000-memory.dmp

    Filesize

    232KB

  • memory/4180-150-0x00000000072C0000-0x00000000077BE000-memory.dmp

    Filesize

    5.0MB

  • memory/4180-149-0x0000000002EA0000-0x0000000002EDC000-memory.dmp

    Filesize

    240KB

  • memory/4180-148-0x0000000002C90000-0x0000000002CD6000-memory.dmp

    Filesize

    280KB

  • memory/4180-959-0x000000000B270000-0x000000000B79C000-memory.dmp

    Filesize

    5.2MB

  • memory/4180-961-0x00000000072B0000-0x00000000072C0000-memory.dmp

    Filesize

    64KB

  • memory/4180-962-0x00000000072B0000-0x00000000072C0000-memory.dmp

    Filesize

    64KB

  • memory/4180-963-0x00000000072B0000-0x00000000072C0000-memory.dmp

    Filesize

    64KB