Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    108s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2023, 16:41

General

  • Target

    2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe

  • Size

    559KB

  • MD5

    2ed975bca125e3df12a654ba67f293e3

  • SHA1

    ed4a367dfe5ec19860debcae9ea12d6c7077ff26

  • SHA256

    2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57

  • SHA512

    b21e02615b588deb3822ffbe04e4ab07eaabb39c36806ca2c3938b0c674b7e236af00385b8f10f94b2f2c57d6b46a3a7d46243f2b03cbab762763370c2a436fa

  • SSDEEP

    12288:sy90pfspWpAwg/PI0xM6bFTia4ekFc9KKMVVbBJTodz3bA:syuA2AwgPM6CRW9dKNc3M

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe
    "C:\Users\Admin\AppData\Local\Temp\2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixb4613.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixb4613.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it749000.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it749000.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3952
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp452426.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp452426.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3472
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 1324
          4⤵
          • Program crash
          PID:4756
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069495.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069495.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2516
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3472 -ip 3472
    1⤵
      PID:4340

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069495.exe

      Filesize

      136KB

      MD5

      49650cdcdc358bb2770f0062abeef88c

      SHA1

      d6f7ec7758e9a80700b81bc7a549838ba99aacac

      SHA256

      79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

      SHA512

      7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069495.exe

      Filesize

      136KB

      MD5

      49650cdcdc358bb2770f0062abeef88c

      SHA1

      d6f7ec7758e9a80700b81bc7a549838ba99aacac

      SHA256

      79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

      SHA512

      7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixb4613.exe

      Filesize

      405KB

      MD5

      83be0edc6067ee65aa6c1b1a287df491

      SHA1

      b362c7ffc0ece0b5e1b2ece45004f745f798dfd1

      SHA256

      513f7dc8f128b53aae0c5621caa099d2447819ed142b8630a8032cdabf3bd384

      SHA512

      fea7fc0217b3c085465893155b56c8ca95151af8da4739d3dae32fa06f9c5ebd1909f3d516dcc34d3e6097b62cf6343a7808f757b9d651adf75863ace6a620ab

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixb4613.exe

      Filesize

      405KB

      MD5

      83be0edc6067ee65aa6c1b1a287df491

      SHA1

      b362c7ffc0ece0b5e1b2ece45004f745f798dfd1

      SHA256

      513f7dc8f128b53aae0c5621caa099d2447819ed142b8630a8032cdabf3bd384

      SHA512

      fea7fc0217b3c085465893155b56c8ca95151af8da4739d3dae32fa06f9c5ebd1909f3d516dcc34d3e6097b62cf6343a7808f757b9d651adf75863ace6a620ab

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it749000.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it749000.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp452426.exe

      Filesize

      352KB

      MD5

      46ec95b8990a01edc2e31bb4b44c61d7

      SHA1

      abf327ec4384751c385fa29d174c6ab79c751eef

      SHA256

      23197dd28100c5a37cbab387c2f6285a39d76d1025f8649504a441c66bb90a9f

      SHA512

      2415d379c1919059026349e124ce05b8166cb91bf901a5918ca0e2f9951acb17358dde9ac506c1be4a22a9b671809851a5f81631bcc5eac082b96fe1af5496cc

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp452426.exe

      Filesize

      352KB

      MD5

      46ec95b8990a01edc2e31bb4b44c61d7

      SHA1

      abf327ec4384751c385fa29d174c6ab79c751eef

      SHA256

      23197dd28100c5a37cbab387c2f6285a39d76d1025f8649504a441c66bb90a9f

      SHA512

      2415d379c1919059026349e124ce05b8166cb91bf901a5918ca0e2f9951acb17358dde9ac506c1be4a22a9b671809851a5f81631bcc5eac082b96fe1af5496cc

    • memory/2516-970-0x00000000001E0000-0x0000000000208000-memory.dmp

      Filesize

      160KB

    • memory/2516-971-0x0000000007450000-0x0000000007460000-memory.dmp

      Filesize

      64KB

    • memory/3472-188-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-202-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-154-0x0000000002BD0000-0x0000000002C16000-memory.dmp

      Filesize

      280KB

    • memory/3472-156-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/3472-157-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-158-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-160-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-162-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-164-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-166-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-168-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-170-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-172-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-174-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-176-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-178-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-180-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-182-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-184-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-186-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-153-0x00000000073B0000-0x0000000007954000-memory.dmp

      Filesize

      5.6MB

    • memory/3472-190-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-192-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-194-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-196-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-198-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-200-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-155-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/3472-204-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-206-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-208-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-210-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-212-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-214-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-216-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-218-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-220-0x0000000004B80000-0x0000000004BB5000-memory.dmp

      Filesize

      212KB

    • memory/3472-949-0x0000000009CE0000-0x000000000A2F8000-memory.dmp

      Filesize

      6.1MB

    • memory/3472-950-0x000000000A320000-0x000000000A332000-memory.dmp

      Filesize

      72KB

    • memory/3472-951-0x000000000A340000-0x000000000A44A000-memory.dmp

      Filesize

      1.0MB

    • memory/3472-952-0x000000000A460000-0x000000000A49C000-memory.dmp

      Filesize

      240KB

    • memory/3472-953-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/3472-954-0x000000000A760000-0x000000000A7C6000-memory.dmp

      Filesize

      408KB

    • memory/3472-955-0x000000000AE20000-0x000000000AEB2000-memory.dmp

      Filesize

      584KB

    • memory/3472-956-0x000000000AEF0000-0x000000000AF40000-memory.dmp

      Filesize

      320KB

    • memory/3472-957-0x000000000AF40000-0x000000000AFB6000-memory.dmp

      Filesize

      472KB

    • memory/3472-958-0x000000000B010000-0x000000000B1D2000-memory.dmp

      Filesize

      1.8MB

    • memory/3472-959-0x000000000B1F0000-0x000000000B71C000-memory.dmp

      Filesize

      5.2MB

    • memory/3472-960-0x000000000B7A0000-0x000000000B7BE000-memory.dmp

      Filesize

      120KB

    • memory/3472-963-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/3472-964-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/3472-965-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/3952-147-0x00000000006C0000-0x00000000006CA000-memory.dmp

      Filesize

      40KB