Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/04/2023, 03:50

General

  • Target

    2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe

  • Size

    560KB

  • MD5

    e84cb4f762f022e87599173899a29d39

  • SHA1

    e7fd10880ea9057ba76bf3c68b86aaf6155b6905

  • SHA256

    2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05

  • SHA512

    b7239ec7602b07c8c33eca633901242a87a2a3a9a7556d8590ddecacbaa99c33cbdd1dbf09a1c08e8f998c5d902a5d050fd43171a8f5da6b62d6da2529eb0a90

  • SSDEEP

    12288:iy90hRcxQMQIvrxK16Fkzv2ZphuoZFTr1BxudVJ8ODcXf:iy0OvpEOx99jjMcP

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe
    "C:\Users\Admin\AppData\Local\Temp\2bd180a8ebc0ea64043abebe13d82232e3f8ae14caf4c931d2cf21ab05d24b05.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTV0966.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTV0966.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it277856.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it277856.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2700
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349377.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349377.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3348
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr145236.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr145236.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3636

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr145236.exe

    Filesize

    136KB

    MD5

    8c80b06d843bd6a7599a5be2075d9a55

    SHA1

    caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

    SHA256

    e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

    SHA512

    cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr145236.exe

    Filesize

    136KB

    MD5

    8c80b06d843bd6a7599a5be2075d9a55

    SHA1

    caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

    SHA256

    e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

    SHA512

    cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTV0966.exe

    Filesize

    406KB

    MD5

    3d9520c77ad53162209b485d0879fb51

    SHA1

    03253a77b9bb9f33103dec4a2ee3354052c035ca

    SHA256

    a893cae81c4b0b02fbb7e10dc44f10ebfc1a240cb3a59b5871fc60fa6661b7f6

    SHA512

    1ee31b314d147b0988d26acab156b7e1b1b8e43b8d7d890e6687576968901d43c3fa45b2bbb416e83498967cb82d993747dceb3f8b456718956fa831f4c61cf9

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziTV0966.exe

    Filesize

    406KB

    MD5

    3d9520c77ad53162209b485d0879fb51

    SHA1

    03253a77b9bb9f33103dec4a2ee3354052c035ca

    SHA256

    a893cae81c4b0b02fbb7e10dc44f10ebfc1a240cb3a59b5871fc60fa6661b7f6

    SHA512

    1ee31b314d147b0988d26acab156b7e1b1b8e43b8d7d890e6687576968901d43c3fa45b2bbb416e83498967cb82d993747dceb3f8b456718956fa831f4c61cf9

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it277856.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it277856.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349377.exe

    Filesize

    353KB

    MD5

    af2e60bc9ae330518c2deff5649d9874

    SHA1

    fa1c924a01679617429f0b9fdfdf382104475352

    SHA256

    8a9b5dab95ec6f72c689e9fb73b8421638ba7b0255d0d3c05542eb0fcc969196

    SHA512

    c8fcbc37182d4ec67908156de73d75695590e247fff83899d1ba3f414baf291775e2c92bc751889319cfb32e05ea0055703018a007636d7de823f5b388a3712f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349377.exe

    Filesize

    353KB

    MD5

    af2e60bc9ae330518c2deff5649d9874

    SHA1

    fa1c924a01679617429f0b9fdfdf382104475352

    SHA256

    8a9b5dab95ec6f72c689e9fb73b8421638ba7b0255d0d3c05542eb0fcc969196

    SHA512

    c8fcbc37182d4ec67908156de73d75695590e247fff83899d1ba3f414baf291775e2c92bc751889319cfb32e05ea0055703018a007636d7de823f5b388a3712f

  • memory/2700-135-0x0000000000C20000-0x0000000000C2A000-memory.dmp

    Filesize

    40KB

  • memory/3348-141-0x0000000004CC0000-0x0000000004CFC000-memory.dmp

    Filesize

    240KB

  • memory/3348-142-0x0000000007250000-0x000000000774E000-memory.dmp

    Filesize

    5.0MB

  • memory/3348-143-0x0000000007190000-0x00000000071CA000-memory.dmp

    Filesize

    232KB

  • memory/3348-145-0x0000000007240000-0x0000000007250000-memory.dmp

    Filesize

    64KB

  • memory/3348-144-0x0000000002CA0000-0x0000000002CE6000-memory.dmp

    Filesize

    280KB

  • memory/3348-147-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-146-0x0000000007240000-0x0000000007250000-memory.dmp

    Filesize

    64KB

  • memory/3348-148-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-150-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-152-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-154-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-156-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-158-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-160-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-162-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-164-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-166-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-168-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-170-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-172-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-174-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-176-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-178-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-180-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-182-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-184-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-186-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-188-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-190-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-192-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-194-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-196-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-198-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-200-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-202-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-204-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-206-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-208-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-210-0x0000000007190000-0x00000000071C5000-memory.dmp

    Filesize

    212KB

  • memory/3348-939-0x000000000A1E0000-0x000000000A7E6000-memory.dmp

    Filesize

    6.0MB

  • memory/3348-940-0x0000000009C10000-0x0000000009C22000-memory.dmp

    Filesize

    72KB

  • memory/3348-941-0x0000000009C30000-0x0000000009D3A000-memory.dmp

    Filesize

    1.0MB

  • memory/3348-942-0x0000000007240000-0x0000000007250000-memory.dmp

    Filesize

    64KB

  • memory/3348-943-0x0000000009D50000-0x0000000009D8E000-memory.dmp

    Filesize

    248KB

  • memory/3348-944-0x0000000009ED0000-0x0000000009F1B000-memory.dmp

    Filesize

    300KB

  • memory/3348-945-0x000000000A060000-0x000000000A0C6000-memory.dmp

    Filesize

    408KB

  • memory/3348-946-0x000000000AD20000-0x000000000ADB2000-memory.dmp

    Filesize

    584KB

  • memory/3348-947-0x000000000ADE0000-0x000000000AE56000-memory.dmp

    Filesize

    472KB

  • memory/3348-948-0x000000000AEB0000-0x000000000B072000-memory.dmp

    Filesize

    1.8MB

  • memory/3348-949-0x000000000B090000-0x000000000B5BC000-memory.dmp

    Filesize

    5.2MB

  • memory/3348-950-0x000000000B6F0000-0x000000000B70E000-memory.dmp

    Filesize

    120KB

  • memory/3348-951-0x0000000004AE0000-0x0000000004B30000-memory.dmp

    Filesize

    320KB

  • memory/3636-958-0x00000000008B0000-0x00000000008D8000-memory.dmp

    Filesize

    160KB

  • memory/3636-959-0x0000000007630000-0x000000000767B000-memory.dmp

    Filesize

    300KB

  • memory/3636-960-0x0000000007930000-0x0000000007940000-memory.dmp

    Filesize

    64KB