Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2023, 10:39

General

  • Target

    552d3d1b61cd87466d966a15ab52b3a52c94b9d5af910f9e73b5fa92b0b1c5d8.exe

  • Size

    707KB

  • MD5

    c927bd121b07f0d863804dc458ca4055

  • SHA1

    484f946abc1dde296d00512be3a46bba1d85e793

  • SHA256

    552d3d1b61cd87466d966a15ab52b3a52c94b9d5af910f9e73b5fa92b0b1c5d8

  • SHA512

    bb6499d94749bd9f81e4eae88c95c9521855b41cd0d86bf5acb5dce6dc22abdfd5bdd5064eb09074eb22c706413325763029b47237b0e4e730a495a447096fed

  • SSDEEP

    12288:Jy90agTemBNIAjUjKmw+DPRVGcqu97uOJk6c/cQ8sAbokr:Jy+Tem2KD+LRVGsFUhGoQ

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\552d3d1b61cd87466d966a15ab52b3a52c94b9d5af910f9e73b5fa92b0b1c5d8.exe
    "C:\Users\Admin\AppData\Local\Temp\552d3d1b61cd87466d966a15ab52b3a52c94b9d5af910f9e73b5fa92b0b1c5d8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4120
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un501447.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un501447.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr653934.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr653934.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3376
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 1088
          4⤵
          • Program crash
          PID:872
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu174565.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu174565.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1136
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 1808
          4⤵
          • Program crash
          PID:1704
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si886776.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si886776.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2648
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3376 -ip 3376
    1⤵
      PID:3460
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1136 -ip 1136
      1⤵
        PID:3248
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:4084

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si886776.exe

        Filesize

        136KB

        MD5

        49650cdcdc358bb2770f0062abeef88c

        SHA1

        d6f7ec7758e9a80700b81bc7a549838ba99aacac

        SHA256

        79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

        SHA512

        7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si886776.exe

        Filesize

        136KB

        MD5

        49650cdcdc358bb2770f0062abeef88c

        SHA1

        d6f7ec7758e9a80700b81bc7a549838ba99aacac

        SHA256

        79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

        SHA512

        7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un501447.exe

        Filesize

        552KB

        MD5

        af6f924f95965c32acdb3b279d300334

        SHA1

        a8cda26ed882e117e52185af78b70f986a4ccd01

        SHA256

        fd85f3ac6844a461959dee79f84b188b694af2573de55d37e3ed17d59455ffa0

        SHA512

        3b5ac1b2e2fb8707ef651e4ebde4fb4a7357347d100df840ba92b4ee323944fae8ec39aa66c3f2a64ffef7f06247e6c2b1219e5b558c65580e89dbec0fdb8d6b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un501447.exe

        Filesize

        552KB

        MD5

        af6f924f95965c32acdb3b279d300334

        SHA1

        a8cda26ed882e117e52185af78b70f986a4ccd01

        SHA256

        fd85f3ac6844a461959dee79f84b188b694af2573de55d37e3ed17d59455ffa0

        SHA512

        3b5ac1b2e2fb8707ef651e4ebde4fb4a7357347d100df840ba92b4ee323944fae8ec39aa66c3f2a64ffef7f06247e6c2b1219e5b558c65580e89dbec0fdb8d6b

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr653934.exe

        Filesize

        279KB

        MD5

        6a4a6f9ee4fba80ce792815e7247a8e2

        SHA1

        b1c5c65dbc90681f985cf8db7b8e0d8013424f90

        SHA256

        1d16d8f639aa51b4941f20319ddb1a01af96d43046d7d2d44b34c46a2fe875c9

        SHA512

        7034903dfb79320e6e6e464140b6e070ab6e87ebad52badab5a3d006207deeb4ec9b41324f6e4a46877712554ba698e73b1d29aab280a9f940fa546214b66fb3

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr653934.exe

        Filesize

        279KB

        MD5

        6a4a6f9ee4fba80ce792815e7247a8e2

        SHA1

        b1c5c65dbc90681f985cf8db7b8e0d8013424f90

        SHA256

        1d16d8f639aa51b4941f20319ddb1a01af96d43046d7d2d44b34c46a2fe875c9

        SHA512

        7034903dfb79320e6e6e464140b6e070ab6e87ebad52badab5a3d006207deeb4ec9b41324f6e4a46877712554ba698e73b1d29aab280a9f940fa546214b66fb3

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu174565.exe

        Filesize

        362KB

        MD5

        1b4b87292b34afaf3ab5b06da9f38e0d

        SHA1

        e441a702caf9cc7bd4bd1cda14e0dba82be35532

        SHA256

        63323a123f157bcd1ad4b18a57ba84b6cc3e79854c21fe1e4e5d371689ee0552

        SHA512

        68c7647e0b39c990dd37e400a724670287c160c638c31cf6038a668c5b0d6d4e43ffa6f561dfd841641007907899be82881cf2c311527c2744d36649834859ed

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu174565.exe

        Filesize

        362KB

        MD5

        1b4b87292b34afaf3ab5b06da9f38e0d

        SHA1

        e441a702caf9cc7bd4bd1cda14e0dba82be35532

        SHA256

        63323a123f157bcd1ad4b18a57ba84b6cc3e79854c21fe1e4e5d371689ee0552

        SHA512

        68c7647e0b39c990dd37e400a724670287c160c638c31cf6038a668c5b0d6d4e43ffa6f561dfd841641007907899be82881cf2c311527c2744d36649834859ed

      • memory/1136-222-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-985-0x0000000009C90000-0x000000000A2A8000-memory.dmp

        Filesize

        6.1MB

      • memory/1136-996-0x0000000004750000-0x00000000047A0000-memory.dmp

        Filesize

        320KB

      • memory/1136-995-0x000000000B380000-0x000000000B8AC000-memory.dmp

        Filesize

        5.2MB

      • memory/1136-994-0x000000000B1B0000-0x000000000B372000-memory.dmp

        Filesize

        1.8MB

      • memory/1136-993-0x000000000AF90000-0x000000000AFAE000-memory.dmp

        Filesize

        120KB

      • memory/1136-992-0x000000000AEF0000-0x000000000AF66000-memory.dmp

        Filesize

        472KB

      • memory/1136-991-0x000000000AE30000-0x000000000AEC2000-memory.dmp

        Filesize

        584KB

      • memory/1136-990-0x000000000A760000-0x000000000A7C6000-memory.dmp

        Filesize

        408KB

      • memory/1136-989-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

        Filesize

        64KB

      • memory/1136-988-0x000000000A470000-0x000000000A4AC000-memory.dmp

        Filesize

        240KB

      • memory/1136-987-0x000000000A340000-0x000000000A44A000-memory.dmp

        Filesize

        1.0MB

      • memory/1136-986-0x000000000A320000-0x000000000A332000-memory.dmp

        Filesize

        72KB

      • memory/1136-226-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-224-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-220-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-218-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-216-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-214-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-212-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-210-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-189-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-190-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-193-0x0000000002BD0000-0x0000000002C16000-memory.dmp

        Filesize

        280KB

      • memory/1136-196-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-197-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

        Filesize

        64KB

      • memory/1136-195-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

        Filesize

        64KB

      • memory/1136-192-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-199-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

        Filesize

        64KB

      • memory/1136-200-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-202-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-204-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-206-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/1136-208-0x0000000004D20000-0x0000000004D55000-memory.dmp

        Filesize

        212KB

      • memory/2648-1003-0x0000000000DA0000-0x0000000000DC8000-memory.dmp

        Filesize

        160KB

      • memory/2648-1004-0x0000000007E40000-0x0000000007E50000-memory.dmp

        Filesize

        64KB

      • memory/3376-172-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-176-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-181-0x0000000007490000-0x00000000074A0000-memory.dmp

        Filesize

        64KB

      • memory/3376-180-0x0000000007490000-0x00000000074A0000-memory.dmp

        Filesize

        64KB

      • memory/3376-150-0x0000000007490000-0x00000000074A0000-memory.dmp

        Filesize

        64KB

      • memory/3376-179-0x0000000000400000-0x0000000002BAF000-memory.dmp

        Filesize

        39.7MB

      • memory/3376-178-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-168-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-170-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-174-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-182-0x0000000007490000-0x00000000074A0000-memory.dmp

        Filesize

        64KB

      • memory/3376-151-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-154-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-166-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-164-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-162-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-160-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-158-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-156-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB

      • memory/3376-149-0x0000000002C80000-0x0000000002CAD000-memory.dmp

        Filesize

        180KB

      • memory/3376-148-0x00000000074A0000-0x0000000007A44000-memory.dmp

        Filesize

        5.6MB

      • memory/3376-184-0x0000000000400000-0x0000000002BAF000-memory.dmp

        Filesize

        39.7MB

      • memory/3376-152-0x00000000049A0000-0x00000000049B2000-memory.dmp

        Filesize

        72KB