Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23/04/2023, 21:27
Static task
static1
General
-
Target
ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe
-
Size
704KB
-
MD5
d195c92420a445689c6e773b3b868a5d
-
SHA1
4fba1c422d3e0eed33a4dd3b6baa302806ff066b
-
SHA256
ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015
-
SHA512
d116104258956b3de4c05d71bd7cabdaaf298efb0c4fdc0edecbd11b4c6ec0a0e46f7bdf3834f97a2ca25f39d1ea8b91789204f886ad2a2890806bfdb1919b4c
-
SSDEEP
12288:ay90GFyk/Xh2CRH/pmuSaD14Y2iY6r9dViwucTXyhlE9I1bzC0BIzwMGu/xu2YdD:ayR/XhJRfpqu1v3r9XzxuhGEHNBIcxtp
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr492254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr492254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr492254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr492254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr492254.exe -
Executes dropped EXE 4 IoCs
pid Process 4432 un253054.exe 4912 pr492254.exe 1040 qu496937.exe 2052 si898320.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr492254.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr492254.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un253054.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un253054.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4912 pr492254.exe 4912 pr492254.exe 1040 qu496937.exe 1040 qu496937.exe 2052 si898320.exe 2052 si898320.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4912 pr492254.exe Token: SeDebugPrivilege 1040 qu496937.exe Token: SeDebugPrivilege 2052 si898320.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4052 wrote to memory of 4432 4052 ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe 67 PID 4052 wrote to memory of 4432 4052 ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe 67 PID 4052 wrote to memory of 4432 4052 ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe 67 PID 4432 wrote to memory of 4912 4432 un253054.exe 68 PID 4432 wrote to memory of 4912 4432 un253054.exe 68 PID 4432 wrote to memory of 4912 4432 un253054.exe 68 PID 4432 wrote to memory of 1040 4432 un253054.exe 69 PID 4432 wrote to memory of 1040 4432 un253054.exe 69 PID 4432 wrote to memory of 1040 4432 un253054.exe 69 PID 4052 wrote to memory of 2052 4052 ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe 71 PID 4052 wrote to memory of 2052 4052 ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe 71 PID 4052 wrote to memory of 2052 4052 ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe 71
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe"C:\Users\Admin\AppData\Local\Temp\ed2693ee1396a1150f8c830313e02e8661275bce056b6ac30abc77ba3f37c015.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un253054.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un253054.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr492254.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr492254.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu496937.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu496937.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si898320.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si898320.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
550KB
MD5829d1461986016bd090b8c9feb7857ed
SHA14f92d024f1fd81a226f9e013283f9b7b250cd431
SHA25605d33e619bcaf1f8428a2fe97183967d822daffcf5ddcc8a7d6f341c4ca6885e
SHA512eb1e49bc92eca8bad8d7c0a9414d2cb376f66fbe3f3b9c603698bd76759ca8ad73afd4be87a47fce737c35f38e4aa58d47074c0d8e7463c1ca58e5b56592bbb4
-
Filesize
550KB
MD5829d1461986016bd090b8c9feb7857ed
SHA14f92d024f1fd81a226f9e013283f9b7b250cd431
SHA25605d33e619bcaf1f8428a2fe97183967d822daffcf5ddcc8a7d6f341c4ca6885e
SHA512eb1e49bc92eca8bad8d7c0a9414d2cb376f66fbe3f3b9c603698bd76759ca8ad73afd4be87a47fce737c35f38e4aa58d47074c0d8e7463c1ca58e5b56592bbb4
-
Filesize
278KB
MD53362d59b9569881d784fe0797dec67ce
SHA11513dff4b25c6de9324bd023204eac512be9ab0c
SHA256e18edc695b5356e6130a73b4ca00e3d7307078cd387a9b57747b89734316ff38
SHA512d6e666f5037a998a1597a71af95608b22dfd7f9b591f69ceced19522b686051f7ea15d3751294beec180630cd08e198fab55a7d1732f23e5ac02e1c219df61d3
-
Filesize
278KB
MD53362d59b9569881d784fe0797dec67ce
SHA11513dff4b25c6de9324bd023204eac512be9ab0c
SHA256e18edc695b5356e6130a73b4ca00e3d7307078cd387a9b57747b89734316ff38
SHA512d6e666f5037a998a1597a71af95608b22dfd7f9b591f69ceced19522b686051f7ea15d3751294beec180630cd08e198fab55a7d1732f23e5ac02e1c219df61d3
-
Filesize
361KB
MD56b8907b833e808aa2e5bf7f1fcad557f
SHA1deb422a1962ddfc4211f3054aa6d7dff67ae4d7c
SHA2561c8e2e6ba121821d6d05ff97d98bbdcc23f2a6d0f0664ce10382b82fd1695933
SHA512921749d12f732a5f8a0a9761061b50236322f760813b968b05ee1d18070519c6cc38470aafa76f8f20a76ea655b282c437782caa9fb606897c3efbfcc7dc8504
-
Filesize
361KB
MD56b8907b833e808aa2e5bf7f1fcad557f
SHA1deb422a1962ddfc4211f3054aa6d7dff67ae4d7c
SHA2561c8e2e6ba121821d6d05ff97d98bbdcc23f2a6d0f0664ce10382b82fd1695933
SHA512921749d12f732a5f8a0a9761061b50236322f760813b968b05ee1d18070519c6cc38470aafa76f8f20a76ea655b282c437782caa9fb606897c3efbfcc7dc8504