Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    56s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/04/2023, 03:32

General

  • Target

    045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe

  • Size

    702KB

  • MD5

    d86bcd070058a20e13cd1ca8a25fbe3d

  • SHA1

    8c501c56e45e018b47fc102ee5c1a92347f1b015

  • SHA256

    045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3

  • SHA512

    db9d04e079bee607484178e263639855d7235f5cd7338d3d5807d3ef0a1ed4b09e13ef99d2d808f2c963e94ce3325869ad1ec09827e496d886db19f8b91213e1

  • SSDEEP

    12288:0y90AfYD29K8fWnslLTbAa2biQWrCGJvphOF4Ffn1BYudeJDFrKK3/x:0yEsK83TiXWBJfF9eTF/x

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe
    "C:\Users\Admin\AppData\Local\Temp\045966cffee12fa9e97c82676ec3b821d73c6176a7059acaa518a4144b1e78e3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un396122.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un396122.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3784
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr995482.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr995482.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3688
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu999152.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu999152.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3924
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si146068.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si146068.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3248

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si146068.exe

    Filesize

    136KB

    MD5

    8c80b06d843bd6a7599a5be2075d9a55

    SHA1

    caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

    SHA256

    e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

    SHA512

    cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si146068.exe

    Filesize

    136KB

    MD5

    8c80b06d843bd6a7599a5be2075d9a55

    SHA1

    caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

    SHA256

    e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

    SHA512

    cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un396122.exe

    Filesize

    548KB

    MD5

    df323e3af35d366b4a228b4720b5565e

    SHA1

    3bd6dd2ee7298a38dc6d090b2c927c20922b5122

    SHA256

    a5ad2bd4c1121145090ee940c9f128fa5aa17373968796316af4c8a12ce01edb

    SHA512

    96e747c17d91fff541e0fd18ca6715c86e8884ccc83bb2572a8c5df4e099ef97ce9582f2fd3d5703b791fa149888b1e2a3556cf0829cc122d394c7456c6dbe11

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un396122.exe

    Filesize

    548KB

    MD5

    df323e3af35d366b4a228b4720b5565e

    SHA1

    3bd6dd2ee7298a38dc6d090b2c927c20922b5122

    SHA256

    a5ad2bd4c1121145090ee940c9f128fa5aa17373968796316af4c8a12ce01edb

    SHA512

    96e747c17d91fff541e0fd18ca6715c86e8884ccc83bb2572a8c5df4e099ef97ce9582f2fd3d5703b791fa149888b1e2a3556cf0829cc122d394c7456c6dbe11

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr995482.exe

    Filesize

    276KB

    MD5

    5c9585c31552f44da6fb18bc41522e2d

    SHA1

    6fd0d61fe2219b666c51e8894a9013accb896094

    SHA256

    b7066ded5c48ac93a310b61e0f3dae02b597cd92ecef1b82b79387f1a19524ed

    SHA512

    4345001b511c725e63b53d2fefa913c42a09c3b4a61dfea4beb7ccd7e20bc1af380be265f2afb11e7254f20a3c31382292fe888c564f617d6d358d2ecd4ae970

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pr995482.exe

    Filesize

    276KB

    MD5

    5c9585c31552f44da6fb18bc41522e2d

    SHA1

    6fd0d61fe2219b666c51e8894a9013accb896094

    SHA256

    b7066ded5c48ac93a310b61e0f3dae02b597cd92ecef1b82b79387f1a19524ed

    SHA512

    4345001b511c725e63b53d2fefa913c42a09c3b4a61dfea4beb7ccd7e20bc1af380be265f2afb11e7254f20a3c31382292fe888c564f617d6d358d2ecd4ae970

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu999152.exe

    Filesize

    353KB

    MD5

    06082577eb6a8be7f79438eeaaabe154

    SHA1

    1e5a50c67857f24516082033f5600876680a3fdc

    SHA256

    ce3c7fa0135765c9713b5126a92abcbb3faef507f4279f69c8f2abf60dcbd5ca

    SHA512

    be4d452d8c9248ddaeae43767bb48b320d355acbb84e9a01dc26ac37b9239b352a36f0facd0283d15dc0d283750f999db84f17575f94d84f3cc6fab9571a94b7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu999152.exe

    Filesize

    353KB

    MD5

    06082577eb6a8be7f79438eeaaabe154

    SHA1

    1e5a50c67857f24516082033f5600876680a3fdc

    SHA256

    ce3c7fa0135765c9713b5126a92abcbb3faef507f4279f69c8f2abf60dcbd5ca

    SHA512

    be4d452d8c9248ddaeae43767bb48b320d355acbb84e9a01dc26ac37b9239b352a36f0facd0283d15dc0d283750f999db84f17575f94d84f3cc6fab9571a94b7

  • memory/3248-993-0x0000000000FB0000-0x0000000000FD8000-memory.dmp

    Filesize

    160KB

  • memory/3248-994-0x0000000007D60000-0x0000000007DAB000-memory.dmp

    Filesize

    300KB

  • memory/3248-995-0x0000000007D10000-0x0000000007D20000-memory.dmp

    Filesize

    64KB

  • memory/3688-144-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-156-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-140-0x0000000004C90000-0x0000000004CA8000-memory.dmp

    Filesize

    96KB

  • memory/3688-141-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-142-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-138-0x0000000007240000-0x0000000007250000-memory.dmp

    Filesize

    64KB

  • memory/3688-146-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-148-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-150-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-152-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-154-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-139-0x0000000007250000-0x000000000774E000-memory.dmp

    Filesize

    5.0MB

  • memory/3688-158-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-160-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-162-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-164-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-166-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-168-0x0000000004C90000-0x0000000004CA2000-memory.dmp

    Filesize

    72KB

  • memory/3688-169-0x0000000000400000-0x0000000002BAE000-memory.dmp

    Filesize

    39.7MB

  • memory/3688-171-0x0000000000400000-0x0000000002BAE000-memory.dmp

    Filesize

    39.7MB

  • memory/3688-137-0x0000000002FE0000-0x0000000002FFA000-memory.dmp

    Filesize

    104KB

  • memory/3688-136-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/3924-179-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-219-0x00000000072E0000-0x00000000072F0000-memory.dmp

    Filesize

    64KB

  • memory/3924-181-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-183-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-185-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-187-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-189-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-191-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-193-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-195-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-197-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-199-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-201-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-203-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-205-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-207-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-209-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-211-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-215-0x0000000002BD0000-0x0000000002C16000-memory.dmp

    Filesize

    280KB

  • memory/3924-178-0x0000000004A30000-0x0000000004A65000-memory.dmp

    Filesize

    212KB

  • memory/3924-221-0x00000000072E0000-0x00000000072F0000-memory.dmp

    Filesize

    64KB

  • memory/3924-217-0x00000000072E0000-0x00000000072F0000-memory.dmp

    Filesize

    64KB

  • memory/3924-974-0x0000000009C70000-0x000000000A276000-memory.dmp

    Filesize

    6.0MB

  • memory/3924-975-0x0000000007290000-0x00000000072A2000-memory.dmp

    Filesize

    72KB

  • memory/3924-976-0x000000000A280000-0x000000000A38A000-memory.dmp

    Filesize

    1.0MB

  • memory/3924-977-0x000000000A390000-0x000000000A3CE000-memory.dmp

    Filesize

    248KB

  • memory/3924-978-0x000000000A3E0000-0x000000000A42B000-memory.dmp

    Filesize

    300KB

  • memory/3924-979-0x00000000072E0000-0x00000000072F0000-memory.dmp

    Filesize

    64KB

  • memory/3924-980-0x000000000A670000-0x000000000A6D6000-memory.dmp

    Filesize

    408KB

  • memory/3924-981-0x000000000AD30000-0x000000000ADC2000-memory.dmp

    Filesize

    584KB

  • memory/3924-982-0x000000000AF10000-0x000000000AF60000-memory.dmp

    Filesize

    320KB

  • memory/3924-983-0x000000000AF80000-0x000000000AFF6000-memory.dmp

    Filesize

    472KB

  • memory/3924-177-0x0000000004A30000-0x0000000004A6A000-memory.dmp

    Filesize

    232KB

  • memory/3924-176-0x0000000002FE0000-0x000000000301C000-memory.dmp

    Filesize

    240KB

  • memory/3924-984-0x000000000B020000-0x000000000B03E000-memory.dmp

    Filesize

    120KB

  • memory/3924-985-0x000000000B0E0000-0x000000000B2A2000-memory.dmp

    Filesize

    1.8MB

  • memory/3924-987-0x000000000B2C0000-0x000000000B7EC000-memory.dmp

    Filesize

    5.2MB