Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
108s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2023, 16:41
Static task
static1
General
-
Target
2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe
-
Size
559KB
-
MD5
2ed975bca125e3df12a654ba67f293e3
-
SHA1
ed4a367dfe5ec19860debcae9ea12d6c7077ff26
-
SHA256
2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57
-
SHA512
b21e02615b588deb3822ffbe04e4ab07eaabb39c36806ca2c3938b0c674b7e236af00385b8f10f94b2f2c57d6b46a3a7d46243f2b03cbab762763370c2a436fa
-
SSDEEP
12288:sy90pfspWpAwg/PI0xM6bFTia4ekFc9KKMVVbBJTodz3bA:syuA2AwgPM6CRW9dKNc3M
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it749000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it749000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it749000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it749000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it749000.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it749000.exe -
Executes dropped EXE 4 IoCs
pid Process 2256 zixb4613.exe 3952 it749000.exe 3472 kp452426.exe 2516 lr069495.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it749000.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zixb4613.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zixb4613.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4756 3472 WerFault.exe 92 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3952 it749000.exe 3952 it749000.exe 3472 kp452426.exe 3472 kp452426.exe 2516 lr069495.exe 2516 lr069495.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3952 it749000.exe Token: SeDebugPrivilege 3472 kp452426.exe Token: SeDebugPrivilege 2516 lr069495.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2256 2240 2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe 86 PID 2240 wrote to memory of 2256 2240 2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe 86 PID 2240 wrote to memory of 2256 2240 2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe 86 PID 2256 wrote to memory of 3952 2256 zixb4613.exe 87 PID 2256 wrote to memory of 3952 2256 zixb4613.exe 87 PID 2256 wrote to memory of 3472 2256 zixb4613.exe 92 PID 2256 wrote to memory of 3472 2256 zixb4613.exe 92 PID 2256 wrote to memory of 3472 2256 zixb4613.exe 92 PID 2240 wrote to memory of 2516 2240 2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe 98 PID 2240 wrote to memory of 2516 2240 2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe 98 PID 2240 wrote to memory of 2516 2240 2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe"C:\Users\Admin\AppData\Local\Temp\2be58db5e7b4ef38c1e08f1c79bcdfaa90a4fe19fabe3bdb0a8d8994c8abad57.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixb4613.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixb4613.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it749000.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it749000.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp452426.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp452426.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 13244⤵
- Program crash
PID:4756
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069495.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069495.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3472 -ip 34721⤵PID:4340
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD549650cdcdc358bb2770f0062abeef88c
SHA1d6f7ec7758e9a80700b81bc7a549838ba99aacac
SHA25679e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59
SHA5127ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1
-
Filesize
136KB
MD549650cdcdc358bb2770f0062abeef88c
SHA1d6f7ec7758e9a80700b81bc7a549838ba99aacac
SHA25679e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59
SHA5127ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1
-
Filesize
405KB
MD583be0edc6067ee65aa6c1b1a287df491
SHA1b362c7ffc0ece0b5e1b2ece45004f745f798dfd1
SHA256513f7dc8f128b53aae0c5621caa099d2447819ed142b8630a8032cdabf3bd384
SHA512fea7fc0217b3c085465893155b56c8ca95151af8da4739d3dae32fa06f9c5ebd1909f3d516dcc34d3e6097b62cf6343a7808f757b9d651adf75863ace6a620ab
-
Filesize
405KB
MD583be0edc6067ee65aa6c1b1a287df491
SHA1b362c7ffc0ece0b5e1b2ece45004f745f798dfd1
SHA256513f7dc8f128b53aae0c5621caa099d2447819ed142b8630a8032cdabf3bd384
SHA512fea7fc0217b3c085465893155b56c8ca95151af8da4739d3dae32fa06f9c5ebd1909f3d516dcc34d3e6097b62cf6343a7808f757b9d651adf75863ace6a620ab
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
352KB
MD546ec95b8990a01edc2e31bb4b44c61d7
SHA1abf327ec4384751c385fa29d174c6ab79c751eef
SHA25623197dd28100c5a37cbab387c2f6285a39d76d1025f8649504a441c66bb90a9f
SHA5122415d379c1919059026349e124ce05b8166cb91bf901a5918ca0e2f9951acb17358dde9ac506c1be4a22a9b671809851a5f81631bcc5eac082b96fe1af5496cc
-
Filesize
352KB
MD546ec95b8990a01edc2e31bb4b44c61d7
SHA1abf327ec4384751c385fa29d174c6ab79c751eef
SHA25623197dd28100c5a37cbab387c2f6285a39d76d1025f8649504a441c66bb90a9f
SHA5122415d379c1919059026349e124ce05b8166cb91bf901a5918ca0e2f9951acb17358dde9ac506c1be4a22a9b671809851a5f81631bcc5eac082b96fe1af5496cc