Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/04/2023, 21:28

General

  • Target

    edf84954fa799e0375970160e6166c836441dd43e944b53f4acf53b0b973d17a.exe

  • Size

    694KB

  • MD5

    81e6a2908d447acd00f22e1cf9f04308

  • SHA1

    013b76f0d2dde625a46819f47c7683b8619f104f

  • SHA256

    edf84954fa799e0375970160e6166c836441dd43e944b53f4acf53b0b973d17a

  • SHA512

    de1570d4424de34efc72dd0f42b4b36b28d703910227e3db281edaa16bd56dfc32af6df49761cf735dcb7ea120fc4cbc3c548561ae7aeaa8009477f10fcf7838

  • SSDEEP

    12288:6y90pEKcj5k8ulRPUyeWbMJWs83co/HW0ElJ6ERSfT7DphaexuBFLXRg8Y9:6yoPcjslJUyeWbXVco/2pBWlbAvLB8

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\edf84954fa799e0375970160e6166c836441dd43e944b53f4acf53b0b973d17a.exe
    "C:\Users\Admin\AppData\Local\Temp\edf84954fa799e0375970160e6166c836441dd43e944b53f4acf53b0b973d17a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un463773.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un463773.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr742782.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr742782.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1684
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1100
          4⤵
          • Program crash
          PID:2372
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu452027.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu452027.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3640
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1816
          4⤵
          • Program crash
          PID:3800
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si482489.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si482489.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4444
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1684 -ip 1684
    1⤵
      PID:1116
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3640 -ip 3640
      1⤵
        PID:5080

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si482489.exe

        Filesize

        136KB

        MD5

        9c75a048f066d01b19ed80dc6e7a7101

        SHA1

        7d37c8ef50e8b83fcdd44032fb082f226ab3d8c3

        SHA256

        c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625

        SHA512

        b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si482489.exe

        Filesize

        136KB

        MD5

        9c75a048f066d01b19ed80dc6e7a7101

        SHA1

        7d37c8ef50e8b83fcdd44032fb082f226ab3d8c3

        SHA256

        c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625

        SHA512

        b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un463773.exe

        Filesize

        540KB

        MD5

        c8720aaec8750352f7f2b7390161f96d

        SHA1

        ad89e55974298c56b2d655fd3718295dbac810c3

        SHA256

        21a0f54166a7619eef7990084419fd1eff25779d2380592a24373d36037a9ff5

        SHA512

        3afa930cf871e9f2837c63cf378784610f97883b57aa14476cc9faf7bdf3770d5147b038049ad0859bc191728ebd542805bd285b689eb55c5beee30a4ecc2e4a

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un463773.exe

        Filesize

        540KB

        MD5

        c8720aaec8750352f7f2b7390161f96d

        SHA1

        ad89e55974298c56b2d655fd3718295dbac810c3

        SHA256

        21a0f54166a7619eef7990084419fd1eff25779d2380592a24373d36037a9ff5

        SHA512

        3afa930cf871e9f2837c63cf378784610f97883b57aa14476cc9faf7bdf3770d5147b038049ad0859bc191728ebd542805bd285b689eb55c5beee30a4ecc2e4a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr742782.exe

        Filesize

        278KB

        MD5

        7540db5a0b0e2d1ec36eb6d1c6121d70

        SHA1

        3a6ac7996a2d528296efe897881ff583b4f18cd8

        SHA256

        71aa483acba7f279f363600ea1f937cb82efd87a8281532fda290c5c55b3d813

        SHA512

        5813219f4e199c155521d41ac32c862d1e892579561689b6b776e61a5a93c4eca11672ed2d7fac16c514d28d57fede9d2b43fc5f816b0595decfbc9fe1cede97

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr742782.exe

        Filesize

        278KB

        MD5

        7540db5a0b0e2d1ec36eb6d1c6121d70

        SHA1

        3a6ac7996a2d528296efe897881ff583b4f18cd8

        SHA256

        71aa483acba7f279f363600ea1f937cb82efd87a8281532fda290c5c55b3d813

        SHA512

        5813219f4e199c155521d41ac32c862d1e892579561689b6b776e61a5a93c4eca11672ed2d7fac16c514d28d57fede9d2b43fc5f816b0595decfbc9fe1cede97

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu452027.exe

        Filesize

        361KB

        MD5

        6ad6232ad21ab877e0a615a2d8cf0c76

        SHA1

        7e063c0e43e0dc7f88ce8aa94e6af5be92b24551

        SHA256

        79c26fa15a09a50865c2ce7f243cf47f11ccec6212645a1bfeaec1882501fb95

        SHA512

        32954386c1636bb0aee38783478604083d361dd65e578332df7ada40eba6e7dc0a58111c3424dd1903ae2430ce1b278f1cc709742908e9f582e2583a0d31ae3d

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu452027.exe

        Filesize

        361KB

        MD5

        6ad6232ad21ab877e0a615a2d8cf0c76

        SHA1

        7e063c0e43e0dc7f88ce8aa94e6af5be92b24551

        SHA256

        79c26fa15a09a50865c2ce7f243cf47f11ccec6212645a1bfeaec1882501fb95

        SHA512

        32954386c1636bb0aee38783478604083d361dd65e578332df7ada40eba6e7dc0a58111c3424dd1903ae2430ce1b278f1cc709742908e9f582e2583a0d31ae3d

      • memory/1684-148-0x0000000007430000-0x00000000079D4000-memory.dmp

        Filesize

        5.6MB

      • memory/1684-149-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-150-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-152-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-154-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-156-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-158-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-162-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-160-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-164-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-166-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-168-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-170-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-172-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-174-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-176-0x0000000004BF0000-0x0000000004C02000-memory.dmp

        Filesize

        72KB

      • memory/1684-177-0x0000000002BB0000-0x0000000002BDD000-memory.dmp

        Filesize

        180KB

      • memory/1684-178-0x0000000007420000-0x0000000007430000-memory.dmp

        Filesize

        64KB

      • memory/1684-179-0x0000000007420000-0x0000000007430000-memory.dmp

        Filesize

        64KB

      • memory/1684-180-0x0000000007420000-0x0000000007430000-memory.dmp

        Filesize

        64KB

      • memory/1684-181-0x0000000000400000-0x0000000002BA6000-memory.dmp

        Filesize

        39.6MB

      • memory/1684-183-0x0000000007420000-0x0000000007430000-memory.dmp

        Filesize

        64KB

      • memory/1684-184-0x0000000007420000-0x0000000007430000-memory.dmp

        Filesize

        64KB

      • memory/1684-185-0x0000000007420000-0x0000000007430000-memory.dmp

        Filesize

        64KB

      • memory/1684-186-0x0000000000400000-0x0000000002BA6000-memory.dmp

        Filesize

        39.6MB

      • memory/3640-191-0x0000000002CC0000-0x0000000002D06000-memory.dmp

        Filesize

        280KB

      • memory/3640-192-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-193-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-195-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-197-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-199-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-201-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/3640-204-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/3640-203-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-202-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/3640-206-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-210-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-208-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-212-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-214-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-216-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-218-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-220-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-222-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-224-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-226-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-228-0x00000000071D0000-0x0000000007205000-memory.dmp

        Filesize

        212KB

      • memory/3640-987-0x0000000009D10000-0x000000000A328000-memory.dmp

        Filesize

        6.1MB

      • memory/3640-988-0x00000000072B0000-0x00000000072C2000-memory.dmp

        Filesize

        72KB

      • memory/3640-989-0x000000000A330000-0x000000000A43A000-memory.dmp

        Filesize

        1.0MB

      • memory/3640-990-0x000000000A460000-0x000000000A49C000-memory.dmp

        Filesize

        240KB

      • memory/3640-991-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/3640-992-0x000000000A750000-0x000000000A7B6000-memory.dmp

        Filesize

        408KB

      • memory/3640-993-0x000000000AE10000-0x000000000AEA2000-memory.dmp

        Filesize

        584KB

      • memory/3640-994-0x000000000AEC0000-0x000000000AF36000-memory.dmp

        Filesize

        472KB

      • memory/3640-995-0x000000000AF90000-0x000000000AFAE000-memory.dmp

        Filesize

        120KB

      • memory/3640-996-0x000000000B1A0000-0x000000000B362000-memory.dmp

        Filesize

        1.8MB

      • memory/3640-997-0x000000000B370000-0x000000000B89C000-memory.dmp

        Filesize

        5.2MB

      • memory/3640-998-0x0000000004890000-0x00000000048E0000-memory.dmp

        Filesize

        320KB

      • memory/4444-1004-0x0000000000890000-0x00000000008B8000-memory.dmp

        Filesize

        160KB

      • memory/4444-1005-0x0000000007A80000-0x0000000007A90000-memory.dmp

        Filesize

        64KB