Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2023, 05:30

General

  • Target

    3b2484353421446e7077601d4480556f4070815b78ad60635f0e8e5907a0c871.exe

  • Size

    705KB

  • MD5

    ac5eb0c24b5270a782158735dc67c3cb

  • SHA1

    cede90760f6e0d2954436862c6c3fe9c2057e760

  • SHA256

    3b2484353421446e7077601d4480556f4070815b78ad60635f0e8e5907a0c871

  • SHA512

    f41fe995bffa7dc1863787a70d77c39d3f44d65c7392372750bb57cf7ece1f13a068c6a5d57e3d711f48cf5140684580e92c1e107ec0534a1cf295c2bea66794

  • SSDEEP

    12288:ky903+JevpSPHJ64BpFIpFywW3f4bEGdrOJY8c0nZZJeGcw8BBev:kyMCeBqtFekwW3fIEQrOTcM3cw8BBev

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b2484353421446e7077601d4480556f4070815b78ad60635f0e8e5907a0c871.exe
    "C:\Users\Admin\AppData\Local\Temp\3b2484353421446e7077601d4480556f4070815b78ad60635f0e8e5907a0c871.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un001953.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un001953.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr877760.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr877760.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2616
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 1092
          4⤵
          • Program crash
          PID:1832
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu942735.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu942735.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1680
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1320
          4⤵
          • Program crash
          PID:4240
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si617199.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si617199.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3616
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2616 -ip 2616
    1⤵
      PID:4628
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1680 -ip 1680
      1⤵
        PID:3784
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:2228

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si617199.exe

        Filesize

        136KB

        MD5

        9c75a048f066d01b19ed80dc6e7a7101

        SHA1

        7d37c8ef50e8b83fcdd44032fb082f226ab3d8c3

        SHA256

        c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625

        SHA512

        b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si617199.exe

        Filesize

        136KB

        MD5

        9c75a048f066d01b19ed80dc6e7a7101

        SHA1

        7d37c8ef50e8b83fcdd44032fb082f226ab3d8c3

        SHA256

        c816d0c862e5001569f4454d0a12c7ee85a7d5afbf3abd896546bba1816d1625

        SHA512

        b70e03a3fcfd29276b36d42ae1b2fedda5de020f0279d798f9fbd1d7f4ac1f10e60cf623e173a55dc42f87d99a83fe9a8db8f6b02a349257d8a2665f84f99e33

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un001953.exe

        Filesize

        551KB

        MD5

        33936d72dea59d73294cb286b0e5c6d5

        SHA1

        38eb8a702da76f20f8f44f567d8835c82b7fac08

        SHA256

        9c8363bc81990e3aa4e3b0e6d266d43e544392e3827944bcc35a1de4566d3ece

        SHA512

        62d9aa6823653b872b730e995be5da31813955d5792d3d4b0573c5e061ecd9f023790ee04d8725b9b655aca1acd494e8e29fceeed2daa161a7e44483ae21ddb1

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un001953.exe

        Filesize

        551KB

        MD5

        33936d72dea59d73294cb286b0e5c6d5

        SHA1

        38eb8a702da76f20f8f44f567d8835c82b7fac08

        SHA256

        9c8363bc81990e3aa4e3b0e6d266d43e544392e3827944bcc35a1de4566d3ece

        SHA512

        62d9aa6823653b872b730e995be5da31813955d5792d3d4b0573c5e061ecd9f023790ee04d8725b9b655aca1acd494e8e29fceeed2daa161a7e44483ae21ddb1

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr877760.exe

        Filesize

        299KB

        MD5

        ffa8f5acd9cde3c35a2b7930beff3ee6

        SHA1

        cdc362724cbce5529d5a0caa3deee7a5ff6d9ab7

        SHA256

        10a379d5866973eac7e31dfdc280b4cae44e7d2a0281f8b256a78c762154ef0f

        SHA512

        4a5e3589c6467168be4284f7d937ad76f3fe2f418126168f5cfdb3ff43f14f86ad068720489e87758f8a2638ca3d1cc8e913b1dbf50f2c60aa78bbf979501dd9

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr877760.exe

        Filesize

        299KB

        MD5

        ffa8f5acd9cde3c35a2b7930beff3ee6

        SHA1

        cdc362724cbce5529d5a0caa3deee7a5ff6d9ab7

        SHA256

        10a379d5866973eac7e31dfdc280b4cae44e7d2a0281f8b256a78c762154ef0f

        SHA512

        4a5e3589c6467168be4284f7d937ad76f3fe2f418126168f5cfdb3ff43f14f86ad068720489e87758f8a2638ca3d1cc8e913b1dbf50f2c60aa78bbf979501dd9

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu942735.exe

        Filesize

        382KB

        MD5

        3b18c549ea901622edc9eec1a3fd7b15

        SHA1

        a776d49e702752d9f53d27f978737796f01eade8

        SHA256

        48c5ccae3a816ac9960a3db46a4ca44dc172a535e8f312f882eac2fe1a3a05b5

        SHA512

        2aab61d9b493b7f4881b45f0a1a7ce3dfe833168f0261256ad6c70c339c2de6f9b83afe56d484930a7ed318cdea24cb79247cd3637282e61494c271a86b07ffc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu942735.exe

        Filesize

        382KB

        MD5

        3b18c549ea901622edc9eec1a3fd7b15

        SHA1

        a776d49e702752d9f53d27f978737796f01eade8

        SHA256

        48c5ccae3a816ac9960a3db46a4ca44dc172a535e8f312f882eac2fe1a3a05b5

        SHA512

        2aab61d9b493b7f4881b45f0a1a7ce3dfe833168f0261256ad6c70c339c2de6f9b83afe56d484930a7ed318cdea24cb79247cd3637282e61494c271a86b07ffc

      • memory/1680-227-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-986-0x0000000009C70000-0x000000000A288000-memory.dmp

        Filesize

        6.1MB

      • memory/1680-997-0x000000000B4D0000-0x000000000B9FC000-memory.dmp

        Filesize

        5.2MB

      • memory/1680-996-0x000000000B300000-0x000000000B4C2000-memory.dmp

        Filesize

        1.8MB

      • memory/1680-995-0x000000000B0E0000-0x000000000B0FE000-memory.dmp

        Filesize

        120KB

      • memory/1680-994-0x000000000B040000-0x000000000B0B6000-memory.dmp

        Filesize

        472KB

      • memory/1680-993-0x000000000AFE0000-0x000000000B030000-memory.dmp

        Filesize

        320KB

      • memory/1680-992-0x000000000AF10000-0x000000000AFA2000-memory.dmp

        Filesize

        584KB

      • memory/1680-991-0x000000000A760000-0x000000000A7C6000-memory.dmp

        Filesize

        408KB

      • memory/1680-990-0x0000000007230000-0x0000000007240000-memory.dmp

        Filesize

        64KB

      • memory/1680-989-0x000000000A470000-0x000000000A4AC000-memory.dmp

        Filesize

        240KB

      • memory/1680-988-0x000000000A340000-0x000000000A44A000-memory.dmp

        Filesize

        1.0MB

      • memory/1680-987-0x000000000A320000-0x000000000A332000-memory.dmp

        Filesize

        72KB

      • memory/1680-225-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-223-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-221-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-219-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-217-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-215-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-213-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-210-0x0000000007230000-0x0000000007240000-memory.dmp

        Filesize

        64KB

      • memory/1680-211-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-207-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-191-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-192-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-194-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-196-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-198-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-200-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-202-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-204-0x00000000071A0000-0x00000000071D5000-memory.dmp

        Filesize

        212KB

      • memory/1680-206-0x0000000002CD0000-0x0000000002D16000-memory.dmp

        Filesize

        280KB

      • memory/1680-208-0x0000000007230000-0x0000000007240000-memory.dmp

        Filesize

        64KB

      • memory/2616-176-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-148-0x0000000002CE0000-0x0000000002D0D000-memory.dmp

        Filesize

        180KB

      • memory/2616-186-0x0000000000400000-0x0000000002BB5000-memory.dmp

        Filesize

        39.7MB

      • memory/2616-184-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/2616-183-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/2616-182-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/2616-181-0x0000000000400000-0x0000000002BB5000-memory.dmp

        Filesize

        39.7MB

      • memory/2616-180-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/2616-179-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/2616-178-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-150-0x0000000007330000-0x00000000078D4000-memory.dmp

        Filesize

        5.6MB

      • memory/2616-172-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-154-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-152-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-151-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-170-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-168-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-166-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-164-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-162-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-160-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-156-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-158-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/2616-149-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/2616-174-0x0000000007260000-0x0000000007272000-memory.dmp

        Filesize

        72KB

      • memory/3616-1004-0x0000000000040000-0x0000000000068000-memory.dmp

        Filesize

        160KB

      • memory/3616-1005-0x00000000070C0000-0x00000000070D0000-memory.dmp

        Filesize

        64KB