Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    53s
  • max time network
    74s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/04/2023, 12:13

General

  • Target

    33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe

  • Size

    707KB

  • MD5

    e0996d2770aa5a18d6a9f5920647e880

  • SHA1

    fb421eb5830655a6b59306ab140a6d4a2486eb86

  • SHA256

    33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd

  • SHA512

    6ca23cec681d4584c68669c4bb9383d374ca896f8c6098f9ef3f42987dc8f7753cb17451ebf7f8c18d4ef8c191c2193309c65ab2ec2a82180169721603d21c18

  • SSDEEP

    12288:by90uUg/t2EOlMedzNx2y9e/Hq/G187tA27ux/uF9CEYzzLiF:byXUcEXMeRNx2Xq/GW7tA26gFkEYzzuF

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe
    "C:\Users\Admin\AppData\Local\Temp\33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815887.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815887.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr271896.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr271896.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2188
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu712019.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu712019.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4532
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si754127.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si754127.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4412

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si754127.exe

    Filesize

    136KB

    MD5

    49650cdcdc358bb2770f0062abeef88c

    SHA1

    d6f7ec7758e9a80700b81bc7a549838ba99aacac

    SHA256

    79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

    SHA512

    7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si754127.exe

    Filesize

    136KB

    MD5

    49650cdcdc358bb2770f0062abeef88c

    SHA1

    d6f7ec7758e9a80700b81bc7a549838ba99aacac

    SHA256

    79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

    SHA512

    7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815887.exe

    Filesize

    552KB

    MD5

    e84ef283734f86ba06faf5eb52edef28

    SHA1

    f2b4c264a1ab643058f219e6411bdfef2fec9ed3

    SHA256

    51dd0be803ea9a786bdad9047df65aaa96104d444400ae850644994ad9c75616

    SHA512

    ef4822b8250b00db4077f04c9b2fb176e0483d0ca7a503cc9c0ba869c872776e711bc8e175a868758afc5d8093771357933696fd0e6e13f74c7a791185c41248

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815887.exe

    Filesize

    552KB

    MD5

    e84ef283734f86ba06faf5eb52edef28

    SHA1

    f2b4c264a1ab643058f219e6411bdfef2fec9ed3

    SHA256

    51dd0be803ea9a786bdad9047df65aaa96104d444400ae850644994ad9c75616

    SHA512

    ef4822b8250b00db4077f04c9b2fb176e0483d0ca7a503cc9c0ba869c872776e711bc8e175a868758afc5d8093771357933696fd0e6e13f74c7a791185c41248

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr271896.exe

    Filesize

    285KB

    MD5

    75f2e5e54aec8bf852a915b6938622e3

    SHA1

    d11cf2cc0abce09b60b81c49004b5ccd056b5898

    SHA256

    9575e274343bbdd0ae718fd67ae1e5f9881179aed425c5cc203ac1c122f83fb6

    SHA512

    27ef5a307b405458dcdef856c910c03d411cd719e7da418382848117ecad9fc896583110d493697590049841a2421a9c7080456ca30a66283d00b000b595aa1b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr271896.exe

    Filesize

    285KB

    MD5

    75f2e5e54aec8bf852a915b6938622e3

    SHA1

    d11cf2cc0abce09b60b81c49004b5ccd056b5898

    SHA256

    9575e274343bbdd0ae718fd67ae1e5f9881179aed425c5cc203ac1c122f83fb6

    SHA512

    27ef5a307b405458dcdef856c910c03d411cd719e7da418382848117ecad9fc896583110d493697590049841a2421a9c7080456ca30a66283d00b000b595aa1b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu712019.exe

    Filesize

    368KB

    MD5

    962db83d30b744fd4a4784c182df8e1b

    SHA1

    cc40f11f73532df1a1e4f9be75351be7b741fb02

    SHA256

    f434037be11a87d9d1f6a95ec38a6bfde5ea8fc41748bfd096aca229a67df902

    SHA512

    06e335cdbbdabdd0d0845662e1a02f624271e2ab0cede3c2eef060a3d5a9ce1eaef6f88a705efcfc2acae1b0a8ac126235c09fcc10490ca993667d545a4482f6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu712019.exe

    Filesize

    368KB

    MD5

    962db83d30b744fd4a4784c182df8e1b

    SHA1

    cc40f11f73532df1a1e4f9be75351be7b741fb02

    SHA256

    f434037be11a87d9d1f6a95ec38a6bfde5ea8fc41748bfd096aca229a67df902

    SHA512

    06e335cdbbdabdd0d0845662e1a02f624271e2ab0cede3c2eef060a3d5a9ce1eaef6f88a705efcfc2acae1b0a8ac126235c09fcc10490ca993667d545a4482f6

  • memory/2188-147-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-157-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-137-0x0000000004C90000-0x0000000004CA8000-memory.dmp

    Filesize

    96KB

  • memory/2188-139-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/2188-140-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/2188-138-0x0000000002C90000-0x0000000002CBD000-memory.dmp

    Filesize

    180KB

  • memory/2188-141-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/2188-142-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-143-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-145-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-135-0x0000000004AA0000-0x0000000004ABA000-memory.dmp

    Filesize

    104KB

  • memory/2188-149-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-151-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-153-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-155-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-136-0x00000000072E0000-0x00000000077DE000-memory.dmp

    Filesize

    5.0MB

  • memory/2188-159-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-161-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-163-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-165-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-167-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-169-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/2188-170-0x0000000000400000-0x0000000002BB1000-memory.dmp

    Filesize

    39.7MB

  • memory/2188-171-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/2188-172-0x00000000072D0000-0x00000000072E0000-memory.dmp

    Filesize

    64KB

  • memory/2188-174-0x0000000000400000-0x0000000002BB1000-memory.dmp

    Filesize

    39.7MB

  • memory/4412-995-0x0000000000700000-0x0000000000728000-memory.dmp

    Filesize

    160KB

  • memory/4412-997-0x0000000007440000-0x0000000007450000-memory.dmp

    Filesize

    64KB

  • memory/4412-996-0x0000000007490000-0x00000000074DB000-memory.dmp

    Filesize

    300KB

  • memory/4532-180-0x0000000004BE0000-0x0000000004C1A000-memory.dmp

    Filesize

    232KB

  • memory/4532-182-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-184-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-187-0x0000000002C20000-0x0000000002C66000-memory.dmp

    Filesize

    280KB

  • memory/4532-189-0x0000000007350000-0x0000000007360000-memory.dmp

    Filesize

    64KB

  • memory/4532-191-0x0000000007350000-0x0000000007360000-memory.dmp

    Filesize

    64KB

  • memory/4532-190-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-186-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-193-0x0000000007350000-0x0000000007360000-memory.dmp

    Filesize

    64KB

  • memory/4532-194-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-196-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-198-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-200-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-202-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-204-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-206-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-208-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-210-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-212-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-214-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-216-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-218-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-977-0x0000000009BE0000-0x000000000A1E6000-memory.dmp

    Filesize

    6.0MB

  • memory/4532-978-0x000000000A210000-0x000000000A222000-memory.dmp

    Filesize

    72KB

  • memory/4532-979-0x000000000A240000-0x000000000A34A000-memory.dmp

    Filesize

    1.0MB

  • memory/4532-980-0x000000000A360000-0x000000000A39E000-memory.dmp

    Filesize

    248KB

  • memory/4532-981-0x000000000A4E0000-0x000000000A52B000-memory.dmp

    Filesize

    300KB

  • memory/4532-982-0x0000000007350000-0x0000000007360000-memory.dmp

    Filesize

    64KB

  • memory/4532-983-0x000000000A670000-0x000000000A6D6000-memory.dmp

    Filesize

    408KB

  • memory/4532-984-0x000000000AD20000-0x000000000ADB2000-memory.dmp

    Filesize

    584KB

  • memory/4532-985-0x000000000ADD0000-0x000000000AE20000-memory.dmp

    Filesize

    320KB

  • memory/4532-986-0x000000000AE40000-0x000000000AEB6000-memory.dmp

    Filesize

    472KB

  • memory/4532-181-0x0000000004BE0000-0x0000000004C15000-memory.dmp

    Filesize

    212KB

  • memory/4532-179-0x0000000004870000-0x00000000048AC000-memory.dmp

    Filesize

    240KB

  • memory/4532-987-0x000000000AFE0000-0x000000000AFFE000-memory.dmp

    Filesize

    120KB

  • memory/4532-988-0x000000000B0B0000-0x000000000B272000-memory.dmp

    Filesize

    1.8MB

  • memory/4532-989-0x000000000B280000-0x000000000B7AC000-memory.dmp

    Filesize

    5.2MB