Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2023, 21:57
Static task
static1
General
-
Target
6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe
-
Size
564KB
-
MD5
c752a12bf0fbc135d0cc3258ac3e36fc
-
SHA1
5940326ad1129530c6f7543a0b1d4dcd0972df62
-
SHA256
6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2
-
SHA512
b541e1ef58b16754c1afd0eda2578442bda2a35e4e24083ecb9706f86f27432b65e6e5349c07bed2f26937524d952e6cc03839a2bd5344969c3b82b41dfe73d5
-
SSDEEP
12288:5y90/+sMYsIZ5Qw7KdStqIzAzp03LfnMT54/sgWeGz9/j:5yYtBf7KAtBsy3LfkOizh
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it836148.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it836148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it836148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it836148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it836148.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it836148.exe -
Executes dropped EXE 4 IoCs
pid Process 2848 zinj8098.exe 1512 it836148.exe 4524 kp851767.exe 2372 lr332059.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it836148.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zinj8098.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zinj8098.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2068 4524 WerFault.exe 90 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1512 it836148.exe 1512 it836148.exe 4524 kp851767.exe 4524 kp851767.exe 2372 lr332059.exe 2372 lr332059.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1512 it836148.exe Token: SeDebugPrivilege 4524 kp851767.exe Token: SeDebugPrivilege 2372 lr332059.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4956 wrote to memory of 2848 4956 6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe 84 PID 4956 wrote to memory of 2848 4956 6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe 84 PID 4956 wrote to memory of 2848 4956 6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe 84 PID 2848 wrote to memory of 1512 2848 zinj8098.exe 85 PID 2848 wrote to memory of 1512 2848 zinj8098.exe 85 PID 2848 wrote to memory of 4524 2848 zinj8098.exe 90 PID 2848 wrote to memory of 4524 2848 zinj8098.exe 90 PID 2848 wrote to memory of 4524 2848 zinj8098.exe 90 PID 4956 wrote to memory of 2372 4956 6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe 96 PID 4956 wrote to memory of 2372 4956 6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe 96 PID 4956 wrote to memory of 2372 4956 6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe"C:\Users\Admin\AppData\Local\Temp\6344236918a4a405c13f159c0b375dfade2a64d1cfabff3a7aad893b247842e2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinj8098.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinj8098.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it836148.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it836148.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp851767.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp851767.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 19804⤵
- Program crash
PID:2068
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr332059.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr332059.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4524 -ip 45241⤵PID:3368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
409KB
MD53b1c20abf0e75d5fe8126840f5686031
SHA164cdff002bc903edc442e2fb7c104480e9c11fc7
SHA256d22db74ae414fecd5e4322a6436aafddcdbdf10884286528fa3fed35e59d8edc
SHA5125bbf52b2a4c34ceede0ad7f15a52c80d2f4ae5f0122ede051a8739212ac99482b1702bed2ad115d26515bb05ca0f3e85c80aa3ef15c38313cb2d0968f4303159
-
Filesize
409KB
MD53b1c20abf0e75d5fe8126840f5686031
SHA164cdff002bc903edc442e2fb7c104480e9c11fc7
SHA256d22db74ae414fecd5e4322a6436aafddcdbdf10884286528fa3fed35e59d8edc
SHA5125bbf52b2a4c34ceede0ad7f15a52c80d2f4ae5f0122ede051a8739212ac99482b1702bed2ad115d26515bb05ca0f3e85c80aa3ef15c38313cb2d0968f4303159
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
361KB
MD5edea7f7d9f47831eecbdb243df4b6251
SHA1a79675a79917a9fc6405a306fabac4cdc774d665
SHA256d42cc5b10b0f9b0f9c7ae607b70e691e0bbb70b8898961862df9d529f8560b1d
SHA5122b02f5ffdd78dbbefab5bc9c77171c1adfde0fc5ed5280c3ff56e1e10ea554952701bc589a2db50f8f87a44503d18ca3420b4b4a031c11ec80eb98db5ce0271c
-
Filesize
361KB
MD5edea7f7d9f47831eecbdb243df4b6251
SHA1a79675a79917a9fc6405a306fabac4cdc774d665
SHA256d42cc5b10b0f9b0f9c7ae607b70e691e0bbb70b8898961862df9d529f8560b1d
SHA5122b02f5ffdd78dbbefab5bc9c77171c1adfde0fc5ed5280c3ff56e1e10ea554952701bc589a2db50f8f87a44503d18ca3420b4b4a031c11ec80eb98db5ce0271c