Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    142s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/04/2023, 02:57

General

  • Target

    94d6c463c205971378ea839bb8a9a3e8d386e89c5077766c70cc7b0f2aa980d5.exe

  • Size

    827KB

  • MD5

    76660ee327ef0fef2755b555491d785d

  • SHA1

    c9b4cb2a1a8c23fa02af25b6c49ea7f88b66ac16

  • SHA256

    94d6c463c205971378ea839bb8a9a3e8d386e89c5077766c70cc7b0f2aa980d5

  • SHA512

    fe5eea58c4d8cad589f51bb32f0e32875fe86f7b174f3502ee72edb2fd501f3f6f85cfad413af5dbebe37a2d1d36d8901a0577a16446aaaaa65a13d145837d83

  • SSDEEP

    12288:Py90qsitI+0deDCMsJ/zb8POJnmCQgDtJpFUIjcp7Hw2P2DZWer:Py8fFdJJ38WnXxDtH6IQ7D2D5

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94d6c463c205971378ea839bb8a9a3e8d386e89c5077766c70cc7b0f2aa980d5.exe
    "C:\Users\Admin\AppData\Local\Temp\94d6c463c205971378ea839bb8a9a3e8d386e89c5077766c70cc7b0f2aa980d5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zich8004.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zich8004.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitO8881.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitO8881.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2064
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it241763.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it241763.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1744
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr955952.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr955952.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2416
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp852116.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp852116.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1812
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr993120.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr993120.exe
      2⤵
      • Executes dropped EXE
      PID:3260
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 620
        3⤵
        • Program crash
        PID:2780
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 700
        3⤵
        • Program crash
        PID:4356
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 840
        3⤵
        • Program crash
        PID:2244
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 884
        3⤵
        • Program crash
        PID:4772
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 844
        3⤵
        • Program crash
        PID:4512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 864
        3⤵
        • Program crash
        PID:4588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 1124
        3⤵
        • Program crash
        PID:2496
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 1148
        3⤵
        • Program crash
        PID:3756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 1096
        3⤵
        • Program crash
        PID:1084

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr993120.exe

    Filesize

    256KB

    MD5

    379f36862d9a1214949af646394a3c64

    SHA1

    b7b6b7431f46a8bf54b9c749e4a3c58bebc284a9

    SHA256

    3534201b908820ede10946f3bafecc76b8a4b27ca80b6d21a71e3778d1e0bacc

    SHA512

    2f420e0d10b56caf0dbd4f07c3616d5a1b2ab96d27f43d167476fd39c7171ce072d53d1d17fa3eefb2aca0cccc2c0f5ff8a5d7795b0957ced64583b2f8faa11d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr993120.exe

    Filesize

    256KB

    MD5

    379f36862d9a1214949af646394a3c64

    SHA1

    b7b6b7431f46a8bf54b9c749e4a3c58bebc284a9

    SHA256

    3534201b908820ede10946f3bafecc76b8a4b27ca80b6d21a71e3778d1e0bacc

    SHA512

    2f420e0d10b56caf0dbd4f07c3616d5a1b2ab96d27f43d167476fd39c7171ce072d53d1d17fa3eefb2aca0cccc2c0f5ff8a5d7795b0957ced64583b2f8faa11d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zich8004.exe

    Filesize

    568KB

    MD5

    e664ec7640e2a192902fc1308d1c254f

    SHA1

    a687796a5ee1089d961f7cb76a1143f24533cd16

    SHA256

    787c783ed5000cf3cb95297e9d64eb35a238cf86ca4da062f31b1698bae1a712

    SHA512

    69837ef53416378a68978ff55b208440eee450721224aa0751b85d3b8cf7f967c9b1fcfb3c4cc4b9eddfa26ff7e6bde4b1614a6df08931d8e98855416b3ab96a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zich8004.exe

    Filesize

    568KB

    MD5

    e664ec7640e2a192902fc1308d1c254f

    SHA1

    a687796a5ee1089d961f7cb76a1143f24533cd16

    SHA256

    787c783ed5000cf3cb95297e9d64eb35a238cf86ca4da062f31b1698bae1a712

    SHA512

    69837ef53416378a68978ff55b208440eee450721224aa0751b85d3b8cf7f967c9b1fcfb3c4cc4b9eddfa26ff7e6bde4b1614a6df08931d8e98855416b3ab96a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp852116.exe

    Filesize

    136KB

    MD5

    86810f340795831f3c2bd147981be929

    SHA1

    573345e2c322720fa43f74d761ff1d48028f36c9

    SHA256

    d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

    SHA512

    c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp852116.exe

    Filesize

    136KB

    MD5

    86810f340795831f3c2bd147981be929

    SHA1

    573345e2c322720fa43f74d761ff1d48028f36c9

    SHA256

    d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

    SHA512

    c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitO8881.exe

    Filesize

    414KB

    MD5

    8f727ea245762e2115f7dcc5b61e69ff

    SHA1

    d91f7338f35553ac30dad3c1902ed26e72e12ec1

    SHA256

    fa80b31ccf7d541cdc99e291bd029d26d414cef34e7e85739bfbf1416911c75a

    SHA512

    5e6b858544bfd8e3afc41d6f46f0a02be325ba9813e1fa9c18bf731503292290f6d714059b7cec0d0ab1de848943e72eb3d6f3bbd21dc581ffa7a15dfebe5e92

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitO8881.exe

    Filesize

    414KB

    MD5

    8f727ea245762e2115f7dcc5b61e69ff

    SHA1

    d91f7338f35553ac30dad3c1902ed26e72e12ec1

    SHA256

    fa80b31ccf7d541cdc99e291bd029d26d414cef34e7e85739bfbf1416911c75a

    SHA512

    5e6b858544bfd8e3afc41d6f46f0a02be325ba9813e1fa9c18bf731503292290f6d714059b7cec0d0ab1de848943e72eb3d6f3bbd21dc581ffa7a15dfebe5e92

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it241763.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it241763.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr955952.exe

    Filesize

    360KB

    MD5

    1333c1bfb1cafd976014befb91a1902f

    SHA1

    71449939a721a4acac911023b64749433ffd8214

    SHA256

    b89c56fd4542d7517adde1437dc6006ff8542fe642dbe9ae3bc66ec0140d639c

    SHA512

    a808f1f1fe48b7ca42619f8c9bf1a2d5d17bc2f5867666840ae47a7b48fda2e75d83b284f39e355edeb55bfa3d022e5530aba4fd72c0e6724d55cb1891aa9241

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr955952.exe

    Filesize

    360KB

    MD5

    1333c1bfb1cafd976014befb91a1902f

    SHA1

    71449939a721a4acac911023b64749433ffd8214

    SHA256

    b89c56fd4542d7517adde1437dc6006ff8542fe642dbe9ae3bc66ec0140d639c

    SHA512

    a808f1f1fe48b7ca42619f8c9bf1a2d5d17bc2f5867666840ae47a7b48fda2e75d83b284f39e355edeb55bfa3d022e5530aba4fd72c0e6724d55cb1891aa9241

  • memory/1744-137-0x0000000000560000-0x000000000056A000-memory.dmp

    Filesize

    40KB

  • memory/1812-959-0x00000000006D0000-0x00000000006F8000-memory.dmp

    Filesize

    160KB

  • memory/1812-960-0x0000000007490000-0x00000000074DB000-memory.dmp

    Filesize

    300KB

  • memory/1812-961-0x0000000007480000-0x0000000007490000-memory.dmp

    Filesize

    64KB

  • memory/2416-178-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-196-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-147-0x0000000007360000-0x0000000007370000-memory.dmp

    Filesize

    64KB

  • memory/2416-149-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-150-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-152-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-154-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-156-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-158-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-160-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-162-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-164-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-166-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-168-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-170-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-172-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-174-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-176-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-146-0x0000000002C90000-0x0000000002CD6000-memory.dmp

    Filesize

    280KB

  • memory/2416-180-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-182-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-184-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-186-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-188-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-190-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-192-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-194-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-148-0x0000000007360000-0x0000000007370000-memory.dmp

    Filesize

    64KB

  • memory/2416-198-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-200-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-202-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-204-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-206-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-208-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-210-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-212-0x0000000004BC0000-0x0000000004BF5000-memory.dmp

    Filesize

    212KB

  • memory/2416-941-0x0000000009BF0000-0x000000000A1F6000-memory.dmp

    Filesize

    6.0MB

  • memory/2416-942-0x000000000A200000-0x000000000A212000-memory.dmp

    Filesize

    72KB

  • memory/2416-943-0x000000000A230000-0x000000000A33A000-memory.dmp

    Filesize

    1.0MB

  • memory/2416-944-0x000000000A350000-0x000000000A38E000-memory.dmp

    Filesize

    248KB

  • memory/2416-945-0x000000000A3D0000-0x000000000A41B000-memory.dmp

    Filesize

    300KB

  • memory/2416-946-0x0000000007360000-0x0000000007370000-memory.dmp

    Filesize

    64KB

  • memory/2416-947-0x000000000A660000-0x000000000A6C6000-memory.dmp

    Filesize

    408KB

  • memory/2416-948-0x000000000AD20000-0x000000000ADB2000-memory.dmp

    Filesize

    584KB

  • memory/2416-949-0x000000000ADE0000-0x000000000AE56000-memory.dmp

    Filesize

    472KB

  • memory/2416-145-0x0000000004BC0000-0x0000000004BFA000-memory.dmp

    Filesize

    232KB

  • memory/2416-144-0x0000000007370000-0x000000000786E000-memory.dmp

    Filesize

    5.0MB

  • memory/2416-143-0x0000000004B40000-0x0000000004B7C000-memory.dmp

    Filesize

    240KB

  • memory/2416-950-0x000000000AEA0000-0x000000000B062000-memory.dmp

    Filesize

    1.8MB

  • memory/2416-951-0x000000000B080000-0x000000000B5AC000-memory.dmp

    Filesize

    5.2MB

  • memory/2416-952-0x000000000B6E0000-0x000000000B6FE000-memory.dmp

    Filesize

    120KB

  • memory/2416-953-0x00000000048E0000-0x0000000004930000-memory.dmp

    Filesize

    320KB

  • memory/3260-967-0x0000000002C70000-0x0000000002CA5000-memory.dmp

    Filesize

    212KB