Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23/04/2023, 03:50
Static task
static1
General
-
Target
2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe
-
Size
560KB
-
MD5
e84cb4f762f022e87599173899a29d39
-
SHA1
e7fd10880ea9057ba76bf3c68b86aaf6155b6905
-
SHA256
2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05
-
SHA512
b7239ec7602b07c8c33eca633901242a87a2a3a9a7556d8590ddecacbaa99c33cbdd1dbf09a1c08e8f998c5d902a5d050fd43171a8f5da6b62d6da2529eb0a90
-
SSDEEP
12288:iy90hRcxQMQIvrxK16Fkzv2ZphuoZFTr1BxudVJ8ODcXf:iy0OvpEOx99jjMcP
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it277856.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it277856.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it277856.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it277856.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it277856.exe -
Executes dropped EXE 4 IoCs
pid Process 2420 ziTV0966.exe 2700 it277856.exe 3348 kp349377.exe 3636 lr145236.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it277856.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziTV0966.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziTV0966.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2700 it277856.exe 2700 it277856.exe 3348 kp349377.exe 3348 kp349377.exe 3636 lr145236.exe 3636 lr145236.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2700 it277856.exe Token: SeDebugPrivilege 3348 kp349377.exe Token: SeDebugPrivilege 3636 lr145236.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2420 2144 2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe 66 PID 2144 wrote to memory of 2420 2144 2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe 66 PID 2144 wrote to memory of 2420 2144 2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe 66 PID 2420 wrote to memory of 2700 2420 ziTV0966.exe 67 PID 2420 wrote to memory of 2700 2420 ziTV0966.exe 67 PID 2420 wrote to memory of 3348 2420 ziTV0966.exe 68 PID 2420 wrote to memory of 3348 2420 ziTV0966.exe 68 PID 2420 wrote to memory of 3348 2420 ziTV0966.exe 68 PID 2144 wrote to memory of 3636 2144 2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe 70 PID 2144 wrote to memory of 3636 2144 2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe 70 PID 2144 wrote to memory of 3636 2144 2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe"C:\Users\Admin\AppData\Local\Temp\2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTV0966.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTV0966.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it277856.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it277856.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349377.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349377.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr145236.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr145236.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
406KB
MD53d9520c77ad53162209b485d0879fb51
SHA103253a77b9bb9f33103dec4a2ee3354052c035ca
SHA256a893cae81c4b0b02fbb7e10dc44f10ebfc1a240cb3a59b5871fc60fa6661b7f6
SHA5121ee31b314d147b0988d26acab156b7e1b1b8e43b8d7d890e6687576968901d43c3fa45b2bbb416e83498967cb82d993747dceb3f8b456718956fa831f4c61cf9
-
Filesize
406KB
MD53d9520c77ad53162209b485d0879fb51
SHA103253a77b9bb9f33103dec4a2ee3354052c035ca
SHA256a893cae81c4b0b02fbb7e10dc44f10ebfc1a240cb3a59b5871fc60fa6661b7f6
SHA5121ee31b314d147b0988d26acab156b7e1b1b8e43b8d7d890e6687576968901d43c3fa45b2bbb416e83498967cb82d993747dceb3f8b456718956fa831f4c61cf9
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
353KB
MD5af2e60bc9ae330518c2deff5649d9874
SHA1fa1c924a01679617429f0b9fdfdf382104475352
SHA2568a9b5dab95ec6f72c689e9fb73b8421638ba7b0255d0d3c05542eb0fcc969196
SHA512c8fcbc37182d4ec67908156de73d75695590e247fff83899d1ba3f414baf291775e2c92bc751889319cfb32e05ea0055703018a007636d7de823f5b388a3712f
-
Filesize
353KB
MD5af2e60bc9ae330518c2deff5649d9874
SHA1fa1c924a01679617429f0b9fdfdf382104475352
SHA2568a9b5dab95ec6f72c689e9fb73b8421638ba7b0255d0d3c05542eb0fcc969196
SHA512c8fcbc37182d4ec67908156de73d75695590e247fff83899d1ba3f414baf291775e2c92bc751889319cfb32e05ea0055703018a007636d7de823f5b388a3712f