Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2023, 20:01

General

  • Target

    c3b5ef6cd9d2733932510618d090a0c4302a26808e1f876c80771fb7430c432e.exe

  • Size

    559KB

  • MD5

    99b2da2c56a36a8a1728ea02bf8ff048

  • SHA1

    05a4c904e88739523adfe60d4d3f305e771e0a0b

  • SHA256

    c3b5ef6cd9d2733932510618d090a0c4302a26808e1f876c80771fb7430c432e

  • SHA512

    364aa41374e59599ecf92106e60801261f68b23f970cdb24e51b2e1f0ff19334fdf16478f4bfa2316c3c8252103c27289eca99f13b03425e1ac60f1be546de3b

  • SSDEEP

    12288:Hy9013F/KJqa3pzMZJxbsG9aLYvSXi6XslT310Z2x:Hy0Ub3pzSh9aQH6Xslr1F

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3b5ef6cd9d2733932510618d090a0c4302a26808e1f876c80771fb7430c432e.exe
    "C:\Users\Admin\AppData\Local\Temp\c3b5ef6cd9d2733932510618d090a0c4302a26808e1f876c80771fb7430c432e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJf3291.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJf3291.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it978393.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it978393.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1432
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp376946.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp376946.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:220
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 1040
          4⤵
          • Program crash
          PID:1848
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr100346.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr100346.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1672
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 220 -ip 220
    1⤵
      PID:2544
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:752

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr100346.exe

      Filesize

      136KB

      MD5

      49650cdcdc358bb2770f0062abeef88c

      SHA1

      d6f7ec7758e9a80700b81bc7a549838ba99aacac

      SHA256

      79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

      SHA512

      7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr100346.exe

      Filesize

      136KB

      MD5

      49650cdcdc358bb2770f0062abeef88c

      SHA1

      d6f7ec7758e9a80700b81bc7a549838ba99aacac

      SHA256

      79e2e1c24f6eb497a4c8071e93ce7ef130b28621b085a3b9ac89a4ecf1ec4e59

      SHA512

      7ca1453671b64b79f2144bb994b7768cc2320ca5da52f2e6ce4d8906f79dae4698943508678bfe02d17f2a7d7910fc42b84c3b605f1e1cea257955e64d0e02e1

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJf3291.exe

      Filesize

      406KB

      MD5

      c483196ee88fe78282e4f00d5dbb25e4

      SHA1

      a2960e807eb53bcd36eb15a50753b8f59d4b091b

      SHA256

      0789099e24076713fec8e42055f2adb6b7a631367b833c83373261c0b73d905f

      SHA512

      3cb49cfacd762a2a4b27de48bdc1a41471050e35546b32dc00eca94be9b3c70d2b2f1dd532364febbd1b685db9225f7574ef542e4f238045d0cb7b9f975e78a3

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJf3291.exe

      Filesize

      406KB

      MD5

      c483196ee88fe78282e4f00d5dbb25e4

      SHA1

      a2960e807eb53bcd36eb15a50753b8f59d4b091b

      SHA256

      0789099e24076713fec8e42055f2adb6b7a631367b833c83373261c0b73d905f

      SHA512

      3cb49cfacd762a2a4b27de48bdc1a41471050e35546b32dc00eca94be9b3c70d2b2f1dd532364febbd1b685db9225f7574ef542e4f238045d0cb7b9f975e78a3

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it978393.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it978393.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp376946.exe

      Filesize

      352KB

      MD5

      5b2f2cc97b04644c0056cfbdc8b33d42

      SHA1

      bc9ece3e2152c4b5c38e603a663ae381dca73e44

      SHA256

      2e79d0c393535f7805930e25c990ce0d23e40845227d5fcc31cb366dd61ebcf4

      SHA512

      a4d53dbefac1d90711c1f8149cd132d4d4089e6ce7bfd1bcca0f32e9923d6197bba9f3b244bdcb795a37e494018f5e262e436287c00ec0db911bc597c136b533

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp376946.exe

      Filesize

      352KB

      MD5

      5b2f2cc97b04644c0056cfbdc8b33d42

      SHA1

      bc9ece3e2152c4b5c38e603a663ae381dca73e44

      SHA256

      2e79d0c393535f7805930e25c990ce0d23e40845227d5fcc31cb366dd61ebcf4

      SHA512

      a4d53dbefac1d90711c1f8149cd132d4d4089e6ce7bfd1bcca0f32e9923d6197bba9f3b244bdcb795a37e494018f5e262e436287c00ec0db911bc597c136b533

    • memory/220-153-0x0000000002D10000-0x0000000002D56000-memory.dmp

      Filesize

      280KB

    • memory/220-154-0x0000000007360000-0x0000000007904000-memory.dmp

      Filesize

      5.6MB

    • memory/220-155-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-156-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-158-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-160-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-162-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-164-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-166-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-168-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-170-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-172-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-174-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-176-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-178-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-180-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-182-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-185-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/220-187-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/220-189-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/220-188-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-184-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-191-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-193-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-195-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-197-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-199-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-201-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-203-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-205-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-207-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-209-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-215-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-213-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-211-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-217-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-219-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-221-0x00000000071A0000-0x00000000071D5000-memory.dmp

      Filesize

      212KB

    • memory/220-950-0x0000000009C90000-0x000000000A2A8000-memory.dmp

      Filesize

      6.1MB

    • memory/220-951-0x000000000A320000-0x000000000A332000-memory.dmp

      Filesize

      72KB

    • memory/220-952-0x000000000A340000-0x000000000A44A000-memory.dmp

      Filesize

      1.0MB

    • memory/220-953-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/220-954-0x000000000A460000-0x000000000A49C000-memory.dmp

      Filesize

      240KB

    • memory/220-955-0x000000000A760000-0x000000000A7C6000-memory.dmp

      Filesize

      408KB

    • memory/220-956-0x000000000AE20000-0x000000000AEB2000-memory.dmp

      Filesize

      584KB

    • memory/220-957-0x000000000AFF0000-0x000000000B066000-memory.dmp

      Filesize

      472KB

    • memory/220-958-0x000000000B0C0000-0x000000000B282000-memory.dmp

      Filesize

      1.8MB

    • memory/220-959-0x000000000B2A0000-0x000000000B7CC000-memory.dmp

      Filesize

      5.2MB

    • memory/220-960-0x000000000B8E0000-0x000000000B8FE000-memory.dmp

      Filesize

      120KB

    • memory/220-961-0x0000000004C60000-0x0000000004CB0000-memory.dmp

      Filesize

      320KB

    • memory/1432-147-0x0000000000410000-0x000000000041A000-memory.dmp

      Filesize

      40KB

    • memory/1672-968-0x0000000000CF0000-0x0000000000D18000-memory.dmp

      Filesize

      160KB

    • memory/1672-969-0x0000000007D50000-0x0000000007D60000-memory.dmp

      Filesize

      64KB