Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21/04/2023, 22:49

General

  • Target

    664041ba758a1f80a40a6077af6578172c7655f9e30140c43198e6992070eeaf.exe

  • Size

    806KB

  • MD5

    ad9b42233d4e152cf144e3941d2cd096

  • SHA1

    1f86245dca4705d573a07fb522815c8ecf5c0e96

  • SHA256

    664041ba758a1f80a40a6077af6578172c7655f9e30140c43198e6992070eeaf

  • SHA512

    3960332f690e0577950776a87898b1abe82b6073a2230a29b6222a12251fc37608b965607cad827f4af2015ccabcee432be8d243dea670886ce8a3fb85158a75

  • SSDEEP

    24576:kyAKkFb6nnu/91ppzZp+PFKBZjHcbeFZWm:zApFT1ppFpPSMW

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\664041ba758a1f80a40a6077af6578172c7655f9e30140c43198e6992070eeaf.exe
    "C:\Users\Admin\AppData\Local\Temp\664041ba758a1f80a40a6077af6578172c7655f9e30140c43198e6992070eeaf.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXq7943.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXq7943.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2600
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJS5921.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJS5921.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it204512.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it204512.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4064
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr713105.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr713105.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3876
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp345543.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp345543.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2268
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr606246.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr606246.exe
      2⤵
      • Executes dropped EXE
      PID:2452
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 616
        3⤵
        • Program crash
        PID:3996
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 696
        3⤵
        • Program crash
        PID:3980
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 836
        3⤵
        • Program crash
        PID:4504
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 816
        3⤵
        • Program crash
        PID:2476
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 880
        3⤵
        • Program crash
        PID:3740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 920
        3⤵
        • Program crash
        PID:4780
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 1116
        3⤵
        • Program crash
        PID:1456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 1148
        3⤵
        • Program crash
        PID:2228
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 1156
        3⤵
        • Program crash
        PID:3632

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr606246.exe

    Filesize

    256KB

    MD5

    7695737d1ddc4f1667c99caf95c57556

    SHA1

    13afd9f9466fafa9b2e1b279ce041be4c1380bba

    SHA256

    6d79e61029a0dc43af49554228f0713ee34e40a6ba0a9cf3e0c2a0b80cee7f50

    SHA512

    2c3d9ed4e7dee9dfd7bb90f0d09f1f9a5a603cc4028256dce9690d99ec837d7fcb75ff8e53e43a9c1713a59ce3cd3133d9fe86f6b95861fd61d48f61d6a29592

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr606246.exe

    Filesize

    256KB

    MD5

    7695737d1ddc4f1667c99caf95c57556

    SHA1

    13afd9f9466fafa9b2e1b279ce041be4c1380bba

    SHA256

    6d79e61029a0dc43af49554228f0713ee34e40a6ba0a9cf3e0c2a0b80cee7f50

    SHA512

    2c3d9ed4e7dee9dfd7bb90f0d09f1f9a5a603cc4028256dce9690d99ec837d7fcb75ff8e53e43a9c1713a59ce3cd3133d9fe86f6b95861fd61d48f61d6a29592

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXq7943.exe

    Filesize

    558KB

    MD5

    1d09d7bca9e0df6e8416a32ff6b7cfd3

    SHA1

    ce2fb9577fb1033a760aace3e8ddf9bc6820fd70

    SHA256

    c4784412d403037deb7c954815e1de5df87e6c33b0a370651700f0de699a5e59

    SHA512

    54100587e3519a59e23e684c389480cdca4c47ab763c2bd4e806e6dbe080a817858960b8438e048bd98a0c39856ef01ce306ee009a52a5cddf2b90f738afde23

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXq7943.exe

    Filesize

    558KB

    MD5

    1d09d7bca9e0df6e8416a32ff6b7cfd3

    SHA1

    ce2fb9577fb1033a760aace3e8ddf9bc6820fd70

    SHA256

    c4784412d403037deb7c954815e1de5df87e6c33b0a370651700f0de699a5e59

    SHA512

    54100587e3519a59e23e684c389480cdca4c47ab763c2bd4e806e6dbe080a817858960b8438e048bd98a0c39856ef01ce306ee009a52a5cddf2b90f738afde23

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp345543.exe

    Filesize

    136KB

    MD5

    9c75a048f066d01b19ed80dc6e7a7101

    SHA1

    7d37c8ef50e8b83fcdd44032fb082f226ab3d8c3

    SHA256

    c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625

    SHA512

    b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp345543.exe

    Filesize

    136KB

    MD5

    9c75a048f066d01b19ed80dc6e7a7101

    SHA1

    7d37c8ef50e8b83fcdd44032fb082f226ab3d8c3

    SHA256

    c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625

    SHA512

    b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJS5921.exe

    Filesize

    404KB

    MD5

    4b26de7864a0129bb92e7758a09799ff

    SHA1

    56bc57abd976f49f5e2a108a99be81e9b8e531ae

    SHA256

    9f5d5036524914a3c85fc455af65e3cfc3c3229e1d109882ac038b8fdd20413e

    SHA512

    b440dffac2037a312f1b2bcab53903ebc8013d4b047cd5c0d8bf5eaed47552f4a8ce2320c2265e0dcc74528c249fa87eecaa2ade81803ea73c968172a96460eb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziJS5921.exe

    Filesize

    404KB

    MD5

    4b26de7864a0129bb92e7758a09799ff

    SHA1

    56bc57abd976f49f5e2a108a99be81e9b8e531ae

    SHA256

    9f5d5036524914a3c85fc455af65e3cfc3c3229e1d109882ac038b8fdd20413e

    SHA512

    b440dffac2037a312f1b2bcab53903ebc8013d4b047cd5c0d8bf5eaed47552f4a8ce2320c2265e0dcc74528c249fa87eecaa2ade81803ea73c968172a96460eb

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it204512.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it204512.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr713105.exe

    Filesize

    360KB

    MD5

    b0a2fda0ab20644bcd945e8ffd580996

    SHA1

    24b422ff87f8be406af3f4266a70c4639aa8c709

    SHA256

    42f184fbeb861c4ee18f8468fc9faa90fe84a3ae041c4c79af6d0bd6fc82b30c

    SHA512

    9431da567af64385247fd227907bed74893745d8b824ff83d004359c594b3db59974618896f420bb76677b302a2935f8c4a7b3aac87f835d3519cd54af869bf9

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr713105.exe

    Filesize

    360KB

    MD5

    b0a2fda0ab20644bcd945e8ffd580996

    SHA1

    24b422ff87f8be406af3f4266a70c4639aa8c709

    SHA256

    42f184fbeb861c4ee18f8468fc9faa90fe84a3ae041c4c79af6d0bd6fc82b30c

    SHA512

    9431da567af64385247fd227907bed74893745d8b824ff83d004359c594b3db59974618896f420bb76677b302a2935f8c4a7b3aac87f835d3519cd54af869bf9

  • memory/2268-966-0x0000000007690000-0x00000000076DB000-memory.dmp

    Filesize

    300KB

  • memory/2268-965-0x0000000000910000-0x0000000000938000-memory.dmp

    Filesize

    160KB

  • memory/2268-967-0x0000000007A00000-0x0000000007A10000-memory.dmp

    Filesize

    64KB

  • memory/2452-973-0x0000000002BB0000-0x0000000002BE5000-memory.dmp

    Filesize

    212KB

  • memory/3876-184-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-202-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-155-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-157-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-162-0x00000000072C0000-0x00000000072D0000-memory.dmp

    Filesize

    64KB

  • memory/3876-160-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-164-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-163-0x00000000072C0000-0x00000000072D0000-memory.dmp

    Filesize

    64KB

  • memory/3876-159-0x00000000072C0000-0x00000000072D0000-memory.dmp

    Filesize

    64KB

  • memory/3876-166-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-168-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-170-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-172-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-174-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-176-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-178-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-180-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-182-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-152-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-186-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-190-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-192-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-188-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-194-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-196-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-198-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-200-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-153-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-204-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-206-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-208-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-210-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-212-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-214-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-216-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-218-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/3876-947-0x000000000A260000-0x000000000A866000-memory.dmp

    Filesize

    6.0MB

  • memory/3876-948-0x0000000007270000-0x0000000007282000-memory.dmp

    Filesize

    72KB

  • memory/3876-949-0x0000000009C50000-0x0000000009D5A000-memory.dmp

    Filesize

    1.0MB

  • memory/3876-950-0x0000000009D60000-0x0000000009D9E000-memory.dmp

    Filesize

    248KB

  • memory/3876-951-0x0000000009ED0000-0x0000000009F1B000-memory.dmp

    Filesize

    300KB

  • memory/3876-952-0x000000000A060000-0x000000000A0C6000-memory.dmp

    Filesize

    408KB

  • memory/3876-953-0x000000000AD20000-0x000000000ADB2000-memory.dmp

    Filesize

    584KB

  • memory/3876-954-0x000000000AED0000-0x000000000AF20000-memory.dmp

    Filesize

    320KB

  • memory/3876-151-0x0000000004D50000-0x0000000004D8A000-memory.dmp

    Filesize

    232KB

  • memory/3876-150-0x00000000072D0000-0x00000000077CE000-memory.dmp

    Filesize

    5.0MB

  • memory/3876-149-0x0000000004CD0000-0x0000000004D0C000-memory.dmp

    Filesize

    240KB

  • memory/3876-148-0x0000000002CD0000-0x0000000002D16000-memory.dmp

    Filesize

    280KB

  • memory/3876-955-0x000000000AF40000-0x000000000AFB6000-memory.dmp

    Filesize

    472KB

  • memory/3876-956-0x000000000AFE0000-0x000000000AFFE000-memory.dmp

    Filesize

    120KB

  • memory/3876-957-0x000000000B0B0000-0x000000000B272000-memory.dmp

    Filesize

    1.8MB

  • memory/3876-958-0x000000000B280000-0x000000000B7AC000-memory.dmp

    Filesize

    5.2MB

  • memory/4064-142-0x0000000000030000-0x000000000003A000-memory.dmp

    Filesize

    40KB