Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
50s -
max time network
71s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
22/04/2023, 10:57
Static task
static1
General
-
Target
aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe
-
Size
704KB
-
MD5
85cd913eabbb97481d76852c19a7c0dc
-
SHA1
a8dab04418cf1090a5ae11fcb7294f6e14c5bd63
-
SHA256
aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804
-
SHA512
c61af6c332364e71d576204f362a3a8def9d54efd8b8fc88bc9ceffaa02a1d0579b33770db72f6c0dab09dcaae6ec2535f45427c42af92af0e97ce73503efd3e
-
SSDEEP
12288:Qy903W8ddMoKDOaDiQ9TsnalPY6NIywS5TxE9OHOR+66fcq8iF0sU+ZfX:QyS45GETsnaldIOEYuwrFxU4fX
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr909161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr909161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr909161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr909161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr909161.exe -
Executes dropped EXE 4 IoCs
pid Process 4560 un408794.exe 5040 pr909161.exe 4872 qu109565.exe 4620 si750050.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr909161.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr909161.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un408794.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un408794.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5040 pr909161.exe 5040 pr909161.exe 4872 qu109565.exe 4872 qu109565.exe 4620 si750050.exe 4620 si750050.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 5040 pr909161.exe Token: SeDebugPrivilege 4872 qu109565.exe Token: SeDebugPrivilege 4620 si750050.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4144 wrote to memory of 4560 4144 aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe 66 PID 4144 wrote to memory of 4560 4144 aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe 66 PID 4144 wrote to memory of 4560 4144 aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe 66 PID 4560 wrote to memory of 5040 4560 un408794.exe 67 PID 4560 wrote to memory of 5040 4560 un408794.exe 67 PID 4560 wrote to memory of 5040 4560 un408794.exe 67 PID 4560 wrote to memory of 4872 4560 un408794.exe 68 PID 4560 wrote to memory of 4872 4560 un408794.exe 68 PID 4560 wrote to memory of 4872 4560 un408794.exe 68 PID 4144 wrote to memory of 4620 4144 aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe 70 PID 4144 wrote to memory of 4620 4144 aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe 70 PID 4144 wrote to memory of 4620 4144 aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe"C:\Users\Admin\AppData\Local\Temp\aa68e294c702b7cc06d926c50481c55a2b9504553fe2fe7d2db91b0c19629804.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un408794.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un408794.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr909161.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr909161.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu109565.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu109565.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si750050.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si750050.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4620
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD549650cdcdc358bb2770f0062abeef88c
SHA1d6f7ec7758e9a80700b81bc7a549838ba99aacac
SHA25679e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59
SHA5127ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1
-
Filesize
136KB
MD549650cdcdc358bb2770f0062abeef88c
SHA1d6f7ec7758e9a80700b81bc7a549838ba99aacac
SHA25679e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59
SHA5127ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1
-
Filesize
550KB
MD5e242f4e5e92e1782009c8976c5ea3cd2
SHA1a2d4b0ae5ee6f9b264e915647c5ca191e8f52a63
SHA256de2bed16fa22e0f58700ed5b28a718839e21760eb467e160c0379305b2e54b67
SHA512d3c3521bbc51be3b23e16c227e6d336da9996f00fee48f506cad09fcc25628630f6871d220f2e3dee6121414e07803672551adff18383059c052970a87ffdb16
-
Filesize
550KB
MD5e242f4e5e92e1782009c8976c5ea3cd2
SHA1a2d4b0ae5ee6f9b264e915647c5ca191e8f52a63
SHA256de2bed16fa22e0f58700ed5b28a718839e21760eb467e160c0379305b2e54b67
SHA512d3c3521bbc51be3b23e16c227e6d336da9996f00fee48f506cad09fcc25628630f6871d220f2e3dee6121414e07803672551adff18383059c052970a87ffdb16
-
Filesize
279KB
MD50c441a908845faf41189360771f55d31
SHA1efc06111495d009131937856d3d321a51b5070a2
SHA25672ee3289f60d5942e33e16abe7da2e203dc0269d11902ed7516a354068cfe48f
SHA512ab9be923b7173f2a2ff4387b0edcb46818b057a2e9168f38bb4cfcabd60ee8d494b49782cb1569481c6a590d402db61ac24b681959549ae50d32a6c29c951e6c
-
Filesize
279KB
MD50c441a908845faf41189360771f55d31
SHA1efc06111495d009131937856d3d321a51b5070a2
SHA25672ee3289f60d5942e33e16abe7da2e203dc0269d11902ed7516a354068cfe48f
SHA512ab9be923b7173f2a2ff4387b0edcb46818b057a2e9168f38bb4cfcabd60ee8d494b49782cb1569481c6a590d402db61ac24b681959549ae50d32a6c29c951e6c
-
Filesize
362KB
MD5be663be3f813216045629f97be2d11f5
SHA185b59549f75272153354ace816377ed431939c2d
SHA2562fb9e28605db35732aebb617d373f653170dcd01c029dfdbe54f50f871e2709e
SHA512369f84a0dc380495bcec267e10ca14b5669df7766411d47aae045c3bb6649f2c41040d56ef83971fee69cc27e86b241e2b2f54489251ccdbe90b43c45c374a59
-
Filesize
362KB
MD5be663be3f813216045629f97be2d11f5
SHA185b59549f75272153354ace816377ed431939c2d
SHA2562fb9e28605db35732aebb617d373f653170dcd01c029dfdbe54f50f871e2709e
SHA512369f84a0dc380495bcec267e10ca14b5669df7766411d47aae045c3bb6649f2c41040d56ef83971fee69cc27e86b241e2b2f54489251ccdbe90b43c45c374a59