Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
56s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23/04/2023, 03:32
Static task
static1
General
-
Target
045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe
-
Size
702KB
-
MD5
d86bcd070058a20e13cd1ca8a25fbe3d
-
SHA1
8c501c56e45e018b47fc102ee5c1a92347f1b015
-
SHA256
045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3
-
SHA512
db9d04e079bee607484178e263639855d7235f5cd7338d3d5807d3ef0a1ed4b09e13ef99d2d808f2c963e94ce3325869ad1ec09827e496d886db19f8b91213e1
-
SSDEEP
12288:0y90AfYD29K8fWnslLTbAa2biQWrCGJvphOF4Ffn1BYudeJDFrKK3/x:0yEsK83TiXWBJfF9eTF/x
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr995482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr995482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr995482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr995482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr995482.exe -
Executes dropped EXE 4 IoCs
pid Process 3784 un396122.exe 3688 pr995482.exe 3924 qu999152.exe 3248 si146068.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr995482.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr995482.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un396122.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un396122.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3688 pr995482.exe 3688 pr995482.exe 3924 qu999152.exe 3924 qu999152.exe 3248 si146068.exe 3248 si146068.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3688 pr995482.exe Token: SeDebugPrivilege 3924 qu999152.exe Token: SeDebugPrivilege 3248 si146068.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3044 wrote to memory of 3784 3044 045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe 66 PID 3044 wrote to memory of 3784 3044 045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe 66 PID 3044 wrote to memory of 3784 3044 045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe 66 PID 3784 wrote to memory of 3688 3784 un396122.exe 67 PID 3784 wrote to memory of 3688 3784 un396122.exe 67 PID 3784 wrote to memory of 3688 3784 un396122.exe 67 PID 3784 wrote to memory of 3924 3784 un396122.exe 68 PID 3784 wrote to memory of 3924 3784 un396122.exe 68 PID 3784 wrote to memory of 3924 3784 un396122.exe 68 PID 3044 wrote to memory of 3248 3044 045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe 70 PID 3044 wrote to memory of 3248 3044 045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe 70 PID 3044 wrote to memory of 3248 3044 045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe"C:\Users\Admin\AppData\Local\Temp\045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un396122.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un396122.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr995482.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr995482.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu999152.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu999152.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si146068.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si146068.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3248
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
548KB
MD5df323e3af35d366b4a228b4720b5565e
SHA13bd6dd2ee7298a38dc6d090b2c927c20922b5122
SHA256a5ad2bd4c1121145090ee940c9f128fa5aa17373968796316af4c8a12ce01edb
SHA51296e747c17d91fff541e0fd18ca6715c86e8884ccc83bb2572a8c5df4e099ef97ce9582f2fd3d5703b791fa149888b1e2a3556cf0829cc122d394c7456c6dbe11
-
Filesize
548KB
MD5df323e3af35d366b4a228b4720b5565e
SHA13bd6dd2ee7298a38dc6d090b2c927c20922b5122
SHA256a5ad2bd4c1121145090ee940c9f128fa5aa17373968796316af4c8a12ce01edb
SHA51296e747c17d91fff541e0fd18ca6715c86e8884ccc83bb2572a8c5df4e099ef97ce9582f2fd3d5703b791fa149888b1e2a3556cf0829cc122d394c7456c6dbe11
-
Filesize
276KB
MD55c9585c31552f44da6fb18bc41522e2d
SHA16fd0d61fe2219b666c51e8894a9013accb896094
SHA256b7066ded5c48ac93a310b61e0f3dae02b597cd92ecef1b82b79387f1a19524ed
SHA5124345001b511c725e63b53d2fefa913c42a09c3b4a61dfea4beb7ccd7e20bc1af380be265f2afb11e7254f20a3c31382292fe888c564f617d6d358d2ecd4ae970
-
Filesize
276KB
MD55c9585c31552f44da6fb18bc41522e2d
SHA16fd0d61fe2219b666c51e8894a9013accb896094
SHA256b7066ded5c48ac93a310b61e0f3dae02b597cd92ecef1b82b79387f1a19524ed
SHA5124345001b511c725e63b53d2fefa913c42a09c3b4a61dfea4beb7ccd7e20bc1af380be265f2afb11e7254f20a3c31382292fe888c564f617d6d358d2ecd4ae970
-
Filesize
353KB
MD506082577eb6a8be7f79438eeaaabe154
SHA11e5a50c67857f24516082033f5600876680a3fdc
SHA256ce3c7fa0135765c9713b5126a92abcbb3faef507f4279f69c8f2abf60dcbd5ca
SHA512be4d452d8c9248ddaeae43767bb48b320d355acbb84e9a01dc26ac37b9239b352a36f0facd0283d15dc0d283750f999db84f17575f94d84f3cc6fab9571a94b7
-
Filesize
353KB
MD506082577eb6a8be7f79438eeaaabe154
SHA11e5a50c67857f24516082033f5600876680a3fdc
SHA256ce3c7fa0135765c9713b5126a92abcbb3faef507f4279f69c8f2abf60dcbd5ca
SHA512be4d452d8c9248ddaeae43767bb48b320d355acbb84e9a01dc26ac37b9239b352a36f0facd0283d15dc0d283750f999db84f17575f94d84f3cc6fab9571a94b7