Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    50s
  • max time network
    71s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/04/2023, 10:57

General

  • Target

    aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe

  • Size

    704KB

  • MD5

    85cd913eabbb97481d76852c19a7c0dc

  • SHA1

    a8dab04418cf1090a5ae11fcb7294f6e14c5bd63

  • SHA256

    aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804

  • SHA512

    c61af6c332364e71d576204f362a3a8def9d54efd8b8fc88bc9ceffaa02a1d0579b33770db72f6c0dab09dcaae6ec2535f45427c42af92af0e97ce73503efd3e

  • SSDEEP

    12288:Qy903W8ddMoKDOaDiQ9TsnalPY6NIywS5TxE9OHOR+66fcq8iF0sU+ZfX:QyS45GETsnaldIOEYuwrFxU4fX

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe
    "C:\Users\Admin\AppData\Local\Temp\aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un408794.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un408794.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr909161.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr909161.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5040
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu109565.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu109565.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4872
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si750050.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si750050.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4620

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si750050.exe

    Filesize

    136KB

    MD5

    49650cdcdc358bb2770f0062abeef88c

    SHA1

    d6f7ec7758e9a80700b81bc7a549838ba99aacac

    SHA256

    79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

    SHA512

    7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si750050.exe

    Filesize

    136KB

    MD5

    49650cdcdc358bb2770f0062abeef88c

    SHA1

    d6f7ec7758e9a80700b81bc7a549838ba99aacac

    SHA256

    79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

    SHA512

    7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un408794.exe

    Filesize

    550KB

    MD5

    e242f4e5e92e1782009c8976c5ea3cd2

    SHA1

    a2d4b0ae5ee6f9b264e915647c5ca191e8f52a63

    SHA256

    de2bed16fa22e0f58700ed5b28a718839e21760eb467e160c0379305b2e54b67

    SHA512

    d3c3521bbc51be3b23e16c227e6d336da9996f00fee48f506cad09fcc25628630f6871d220f2e3dee6121414e07803672551adff18383059c052970a87ffdb16

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un408794.exe

    Filesize

    550KB

    MD5

    e242f4e5e92e1782009c8976c5ea3cd2

    SHA1

    a2d4b0ae5ee6f9b264e915647c5ca191e8f52a63

    SHA256

    de2bed16fa22e0f58700ed5b28a718839e21760eb467e160c0379305b2e54b67

    SHA512

    d3c3521bbc51be3b23e16c227e6d336da9996f00fee48f506cad09fcc25628630f6871d220f2e3dee6121414e07803672551adff18383059c052970a87ffdb16

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr909161.exe

    Filesize

    279KB

    MD5

    0c441a908845faf41189360771f55d31

    SHA1

    efc06111495d009131937856d3d321a51b5070a2

    SHA256

    72ee3289f60d5942e33e16abe7da2e203dc0269d11902ed7516a354068cfe48f

    SHA512

    ab9be923b7173f2a2ff4387b0edcb46818b057a2e9168f38bb4cfcabd60ee8d494b49782cb1569481c6a590d402db61ac24b681959549ae50d32a6c29c951e6c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr909161.exe

    Filesize

    279KB

    MD5

    0c441a908845faf41189360771f55d31

    SHA1

    efc06111495d009131937856d3d321a51b5070a2

    SHA256

    72ee3289f60d5942e33e16abe7da2e203dc0269d11902ed7516a354068cfe48f

    SHA512

    ab9be923b7173f2a2ff4387b0edcb46818b057a2e9168f38bb4cfcabd60ee8d494b49782cb1569481c6a590d402db61ac24b681959549ae50d32a6c29c951e6c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu109565.exe

    Filesize

    362KB

    MD5

    be663be3f813216045629f97be2d11f5

    SHA1

    85b59549f75272153354ace816377ed431939c2d

    SHA256

    2fb9e28605db35732aebb617d373f653170dcd01c029dfdbe54f50f871e2709e

    SHA512

    369f84a0dc380495bcec267e10ca14b5669df7766411d47aae045c3bb6649f2c41040d56ef83971fee69cc27e86b241e2b2f54489251ccdbe90b43c45c374a59

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu109565.exe

    Filesize

    362KB

    MD5

    be663be3f813216045629f97be2d11f5

    SHA1

    85b59549f75272153354ace816377ed431939c2d

    SHA256

    2fb9e28605db35732aebb617d373f653170dcd01c029dfdbe54f50f871e2709e

    SHA512

    369f84a0dc380495bcec267e10ca14b5669df7766411d47aae045c3bb6649f2c41040d56ef83971fee69cc27e86b241e2b2f54489251ccdbe90b43c45c374a59

  • memory/4620-995-0x00000000076F0000-0x0000000007700000-memory.dmp

    Filesize

    64KB

  • memory/4620-994-0x0000000007700000-0x000000000774B000-memory.dmp

    Filesize

    300KB

  • memory/4620-993-0x0000000000950000-0x0000000000978000-memory.dmp

    Filesize

    160KB

  • memory/4872-210-0x00000000071A0000-0x00000000071B0000-memory.dmp

    Filesize

    64KB

  • memory/4872-974-0x0000000009C30000-0x000000000A236000-memory.dmp

    Filesize

    6.0MB

  • memory/4872-987-0x000000000BA30000-0x000000000BA4E000-memory.dmp

    Filesize

    120KB

  • memory/4872-986-0x000000000B1F0000-0x000000000B71C000-memory.dmp

    Filesize

    5.2MB

  • memory/4872-985-0x000000000B020000-0x000000000B1E2000-memory.dmp

    Filesize

    1.8MB

  • memory/4872-984-0x000000000AF40000-0x000000000AFB6000-memory.dmp

    Filesize

    472KB

  • memory/4872-983-0x000000000AED0000-0x000000000AF20000-memory.dmp

    Filesize

    320KB

  • memory/4872-981-0x000000000AD30000-0x000000000ADC2000-memory.dmp

    Filesize

    584KB

  • memory/4872-980-0x000000000A670000-0x000000000A6D6000-memory.dmp

    Filesize

    408KB

  • memory/4872-979-0x000000000A4E0000-0x000000000A52B000-memory.dmp

    Filesize

    300KB

  • memory/4872-978-0x000000000A360000-0x000000000A39E000-memory.dmp

    Filesize

    248KB

  • memory/4872-977-0x00000000071A0000-0x00000000071B0000-memory.dmp

    Filesize

    64KB

  • memory/4872-976-0x000000000A240000-0x000000000A34A000-memory.dmp

    Filesize

    1.0MB

  • memory/4872-975-0x0000000007170000-0x0000000007182000-memory.dmp

    Filesize

    72KB

  • memory/4872-215-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-213-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-208-0x00000000071A0000-0x00000000071B0000-memory.dmp

    Filesize

    64KB

  • memory/4872-211-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-207-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-206-0x00000000071A0000-0x00000000071B0000-memory.dmp

    Filesize

    64KB

  • memory/4872-205-0x0000000002CF0000-0x0000000002D36000-memory.dmp

    Filesize

    280KB

  • memory/4872-203-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-176-0x0000000004750000-0x000000000478C000-memory.dmp

    Filesize

    240KB

  • memory/4872-177-0x0000000004C00000-0x0000000004C3A000-memory.dmp

    Filesize

    232KB

  • memory/4872-178-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-179-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-181-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-183-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-185-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-187-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-189-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-191-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-193-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-195-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-197-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-199-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/4872-201-0x0000000004C00000-0x0000000004C35000-memory.dmp

    Filesize

    212KB

  • memory/5040-163-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-133-0x00000000048B0000-0x00000000048C8000-memory.dmp

    Filesize

    96KB

  • memory/5040-168-0x0000000000400000-0x0000000002BAF000-memory.dmp

    Filesize

    39.7MB

  • memory/5040-171-0x0000000007310000-0x0000000007320000-memory.dmp

    Filesize

    64KB

  • memory/5040-170-0x0000000007310000-0x0000000007320000-memory.dmp

    Filesize

    64KB

  • memory/5040-169-0x0000000007310000-0x0000000007320000-memory.dmp

    Filesize

    64KB

  • memory/5040-137-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-166-0x0000000000400000-0x0000000002BAF000-memory.dmp

    Filesize

    39.7MB

  • memory/5040-165-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-143-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-155-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-159-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-141-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-139-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-156-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/5040-160-0x0000000007310000-0x0000000007320000-memory.dmp

    Filesize

    64KB

  • memory/5040-158-0x0000000007310000-0x0000000007320000-memory.dmp

    Filesize

    64KB

  • memory/5040-153-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-151-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-149-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-147-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-145-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-135-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-134-0x00000000048B0000-0x00000000048C2000-memory.dmp

    Filesize

    72KB

  • memory/5040-161-0x0000000007310000-0x0000000007320000-memory.dmp

    Filesize

    64KB

  • memory/5040-132-0x0000000007320000-0x000000000781E000-memory.dmp

    Filesize

    5.0MB

  • memory/5040-131-0x0000000002DD0000-0x0000000002DEA000-memory.dmp

    Filesize

    104KB