Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
67s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23/04/2023, 08:51
Static task
static1
General
-
Target
aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe
-
Size
566KB
-
MD5
693243f07af348dc799d9558408359c0
-
SHA1
435b04deeae4b44d2b0fe7e96996536b1fcd6383
-
SHA256
aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1
-
SHA512
b34c8f2b92b2318de0660779d1949214a2ef8db6622f5dcd55d243bbdb523ed25144b022703c5d98b150c104db5fc54ac1339a2fa3de78377f4558d74510a05f
-
SSDEEP
12288:1y90DyzcKj3RW7yUMcKfdw80h3n2saAueIn04IrETK:1y8ccKlWAfdX+nXaAue804IrsK
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it114986.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it114986.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it114986.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it114986.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it114986.exe -
Executes dropped EXE 4 IoCs
pid Process 2268 ziBR5463.exe 2520 it114986.exe 2856 kp282134.exe 1228 lr606352.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it114986.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziBR5463.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziBR5463.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2520 it114986.exe 2520 it114986.exe 2856 kp282134.exe 2856 kp282134.exe 1228 lr606352.exe 1228 lr606352.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2520 it114986.exe Token: SeDebugPrivilege 2856 kp282134.exe Token: SeDebugPrivilege 1228 lr606352.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2268 2052 aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe 66 PID 2052 wrote to memory of 2268 2052 aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe 66 PID 2052 wrote to memory of 2268 2052 aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe 66 PID 2268 wrote to memory of 2520 2268 ziBR5463.exe 67 PID 2268 wrote to memory of 2520 2268 ziBR5463.exe 67 PID 2268 wrote to memory of 2856 2268 ziBR5463.exe 68 PID 2268 wrote to memory of 2856 2268 ziBR5463.exe 68 PID 2268 wrote to memory of 2856 2268 ziBR5463.exe 68 PID 2052 wrote to memory of 1228 2052 aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe 70 PID 2052 wrote to memory of 1228 2052 aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe 70 PID 2052 wrote to memory of 1228 2052 aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe"C:\Users\Admin\AppData\Local\Temp\aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBR5463.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBR5463.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it114986.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it114986.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp282134.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp282134.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr606352.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr606352.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
136KB
MD58c80b06d843bd6a7599a5be2075d9a55
SHA1caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2
SHA256e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e
SHA512cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded
-
Filesize
412KB
MD5b56bd4cc31118902560140dedb32cdf8
SHA134f3b1357b3eeb5b168581cc9af02c0f577887db
SHA2563daf875177226962f0fc6a45a0e143620af48ac3b6c4b85d8f066eddf5abf35e
SHA512d87bc4e42dee8d4e5de75723f10d7502e3d6e892d490c0a9b8edc0abb834bf5c19c1b2b1c6f96755eab0010437b98106f319151c70de0836ebfc70f31419197b
-
Filesize
412KB
MD5b56bd4cc31118902560140dedb32cdf8
SHA134f3b1357b3eeb5b168581cc9af02c0f577887db
SHA2563daf875177226962f0fc6a45a0e143620af48ac3b6c4b85d8f066eddf5abf35e
SHA512d87bc4e42dee8d4e5de75723f10d7502e3d6e892d490c0a9b8edc0abb834bf5c19c1b2b1c6f96755eab0010437b98106f319151c70de0836ebfc70f31419197b
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
368KB
MD5b2e0f8ad627787f1cedf7ea519e35bf1
SHA1de72c06188d846a128db88df40eacdea126f5f72
SHA2562b6e5a7c5c199d729c8c27db8732d92fbaa36fbcd978a3287e903f70b89eabdc
SHA512b37738dde115ad96e8c2447847582df8ceaac2c6814c89184709f9606caf6421e79261bb9c2af12f5a1220118ae5fb2b46589a64331358d2d39c7fac0d818aac
-
Filesize
368KB
MD5b2e0f8ad627787f1cedf7ea519e35bf1
SHA1de72c06188d846a128db88df40eacdea126f5f72
SHA2562b6e5a7c5c199d729c8c27db8732d92fbaa36fbcd978a3287e903f70b89eabdc
SHA512b37738dde115ad96e8c2447847582df8ceaac2c6814c89184709f9606caf6421e79261bb9c2af12f5a1220118ae5fb2b46589a64331358d2d39c7fac0d818aac