Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
53s -
max time network
74s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
22/04/2023, 12:13
Static task
static1
General
-
Target
33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe
-
Size
707KB
-
MD5
e0996d2770aa5a18d6a9f5920647e880
-
SHA1
fb421eb5830655a6b59306ab140a6d4a2486eb86
-
SHA256
33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd
-
SHA512
6ca23cec681d4584c68669c4bb9383d374ca896f8c6098f9ef3f42987dc8f7753cb17451ebf7f8c18d4ef8c191c2193309c65ab2ec2a82180169721603d21c18
-
SSDEEP
12288:by90uUg/t2EOlMedzNx2y9e/Hq/G187tA27ux/uF9CEYzzLiF:byXUcEXMeRNx2Xq/GW7tA26gFkEYzzuF
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr271896.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr271896.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr271896.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr271896.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr271896.exe -
Executes dropped EXE 4 IoCs
pid Process 4188 un815887.exe 2188 pr271896.exe 4532 qu712019.exe 4412 si754127.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr271896.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr271896.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un815887.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un815887.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2188 pr271896.exe 2188 pr271896.exe 4532 qu712019.exe 4532 qu712019.exe 4412 si754127.exe 4412 si754127.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2188 pr271896.exe Token: SeDebugPrivilege 4532 qu712019.exe Token: SeDebugPrivilege 4412 si754127.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4768 wrote to memory of 4188 4768 33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe 66 PID 4768 wrote to memory of 4188 4768 33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe 66 PID 4768 wrote to memory of 4188 4768 33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe 66 PID 4188 wrote to memory of 2188 4188 un815887.exe 67 PID 4188 wrote to memory of 2188 4188 un815887.exe 67 PID 4188 wrote to memory of 2188 4188 un815887.exe 67 PID 4188 wrote to memory of 4532 4188 un815887.exe 68 PID 4188 wrote to memory of 4532 4188 un815887.exe 68 PID 4188 wrote to memory of 4532 4188 un815887.exe 68 PID 4768 wrote to memory of 4412 4768 33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe 70 PID 4768 wrote to memory of 4412 4768 33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe 70 PID 4768 wrote to memory of 4412 4768 33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe"C:\Users\Admin\AppData\Local\Temp\33e8ca1978fd20bf8d6dfa4c6248a88b303d53d50943878b1bd08fc498f40abd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815887.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815887.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr271896.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr271896.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu712019.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu712019.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si754127.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si754127.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD549650cdcdc358bb2770f0062abeef88c
SHA1d6f7ec7758e9a80700b81bc7a549838ba99aacac
SHA25679e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59
SHA5127ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1
-
Filesize
136KB
MD549650cdcdc358bb2770f0062abeef88c
SHA1d6f7ec7758e9a80700b81bc7a549838ba99aacac
SHA25679e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59
SHA5127ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1
-
Filesize
552KB
MD5e84ef283734f86ba06faf5eb52edef28
SHA1f2b4c264a1ab643058f219e6411bdfef2fec9ed3
SHA25651dd0be803ea9a786bdad9047df65aaa96104d444400ae850644994ad9c75616
SHA512ef4822b8250b00db4077f04c9b2fb176e0483d0ca7a503cc9c0ba869c872776e711bc8e175a868758afc5d8093771357933696fd0e6e13f74c7a791185c41248
-
Filesize
552KB
MD5e84ef283734f86ba06faf5eb52edef28
SHA1f2b4c264a1ab643058f219e6411bdfef2fec9ed3
SHA25651dd0be803ea9a786bdad9047df65aaa96104d444400ae850644994ad9c75616
SHA512ef4822b8250b00db4077f04c9b2fb176e0483d0ca7a503cc9c0ba869c872776e711bc8e175a868758afc5d8093771357933696fd0e6e13f74c7a791185c41248
-
Filesize
285KB
MD575f2e5e54aec8bf852a915b6938622e3
SHA1d11cf2cc0abce09b60b81c49004b5ccd056b5898
SHA2569575e274343bbdd0ae718fd67ae1e5f9881179aed425c5cc203ac1c122f83fb6
SHA51227ef5a307b405458dcdef856c910c03d411cd719e7da418382848117ecad9fc896583110d493697590049841a2421a9c7080456ca30a66283d00b000b595aa1b
-
Filesize
285KB
MD575f2e5e54aec8bf852a915b6938622e3
SHA1d11cf2cc0abce09b60b81c49004b5ccd056b5898
SHA2569575e274343bbdd0ae718fd67ae1e5f9881179aed425c5cc203ac1c122f83fb6
SHA51227ef5a307b405458dcdef856c910c03d411cd719e7da418382848117ecad9fc896583110d493697590049841a2421a9c7080456ca30a66283d00b000b595aa1b
-
Filesize
368KB
MD5962db83d30b744fd4a4784c182df8e1b
SHA1cc40f11f73532df1a1e4f9be75351be7b741fb02
SHA256f434037be11a87d9d1f6a95ec38a6bfde5ea8fc41748bfd096aca229a67df902
SHA51206e335cdbbdabdd0d0845662e1a02f624271e2ab0cede3c2eef060a3d5a9ce1eaef6f88a705efcfc2acae1b0a8ac126235c09fcc10490ca993667d545a4482f6
-
Filesize
368KB
MD5962db83d30b744fd4a4784c182df8e1b
SHA1cc40f11f73532df1a1e4f9be75351be7b741fb02
SHA256f434037be11a87d9d1f6a95ec38a6bfde5ea8fc41748bfd096aca229a67df902
SHA51206e335cdbbdabdd0d0845662e1a02f624271e2ab0cede3c2eef060a3d5a9ce1eaef6f88a705efcfc2acae1b0a8ac126235c09fcc10490ca993667d545a4482f6