Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    67s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/04/2023, 08:51

General

  • Target

    aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe

  • Size

    566KB

  • MD5

    693243f07af348dc799d9558408359c0

  • SHA1

    435b04deeae4b44d2b0fe7e96996536b1fcd6383

  • SHA256

    aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1

  • SHA512

    b34c8f2b92b2318de0660779d1949214a2ef8db6622f5dcd55d243bbdb523ed25144b022703c5d98b150c104db5fc54ac1339a2fa3de78377f4558d74510a05f

  • SSDEEP

    12288:1y90DyzcKj3RW7yUMcKfdw80h3n2saAueIn04IrETK:1y8ccKlWAfdX+nXaAue804IrsK

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe
    "C:\Users\Admin\AppData\Local\Temp\aad6c5cacbc112efbef3ee62077eb16b2d0b95fa34043bfe102940c7acedf6c1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2052
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBR5463.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBR5463.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2268
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it114986.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it114986.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2520
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp282134.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp282134.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2856
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr606352.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr606352.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr606352.exe

    Filesize

    136KB

    MD5

    8c80b06d843bd6a7599a5be2075d9a55

    SHA1

    caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

    SHA256

    e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

    SHA512

    cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr606352.exe

    Filesize

    136KB

    MD5

    8c80b06d843bd6a7599a5be2075d9a55

    SHA1

    caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

    SHA256

    e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

    SHA512

    cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBR5463.exe

    Filesize

    412KB

    MD5

    b56bd4cc31118902560140dedb32cdf8

    SHA1

    34f3b1357b3eeb5b168581cc9af02c0f577887db

    SHA256

    3daf875177226962f0fc6a45a0e143620af48ac3b6c4b85d8f066eddf5abf35e

    SHA512

    d87bc4e42dee8d4e5de75723f10d7502e3d6e892d490c0a9b8edc0abb834bf5c19c1b2b1c6f96755eab0010437b98106f319151c70de0836ebfc70f31419197b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziBR5463.exe

    Filesize

    412KB

    MD5

    b56bd4cc31118902560140dedb32cdf8

    SHA1

    34f3b1357b3eeb5b168581cc9af02c0f577887db

    SHA256

    3daf875177226962f0fc6a45a0e143620af48ac3b6c4b85d8f066eddf5abf35e

    SHA512

    d87bc4e42dee8d4e5de75723f10d7502e3d6e892d490c0a9b8edc0abb834bf5c19c1b2b1c6f96755eab0010437b98106f319151c70de0836ebfc70f31419197b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it114986.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it114986.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp282134.exe

    Filesize

    368KB

    MD5

    b2e0f8ad627787f1cedf7ea519e35bf1

    SHA1

    de72c06188d846a128db88df40eacdea126f5f72

    SHA256

    2b6e5a7c5c199d729c8c27db8732d92fbaa36fbcd978a3287e903f70b89eabdc

    SHA512

    b37738dde115ad96e8c2447847582df8ceaac2c6814c89184709f9606caf6421e79261bb9c2af12f5a1220118ae5fb2b46589a64331358d2d39c7fac0d818aac

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp282134.exe

    Filesize

    368KB

    MD5

    b2e0f8ad627787f1cedf7ea519e35bf1

    SHA1

    de72c06188d846a128db88df40eacdea126f5f72

    SHA256

    2b6e5a7c5c199d729c8c27db8732d92fbaa36fbcd978a3287e903f70b89eabdc

    SHA512

    b37738dde115ad96e8c2447847582df8ceaac2c6814c89184709f9606caf6421e79261bb9c2af12f5a1220118ae5fb2b46589a64331358d2d39c7fac0d818aac

  • memory/1228-959-0x0000000000490000-0x00000000004B8000-memory.dmp

    Filesize

    160KB

  • memory/1228-960-0x0000000007210000-0x000000000725B000-memory.dmp

    Filesize

    300KB

  • memory/1228-961-0x0000000007270000-0x0000000007280000-memory.dmp

    Filesize

    64KB

  • memory/2520-135-0x00000000005F0000-0x00000000005FA000-memory.dmp

    Filesize

    40KB

  • memory/2856-176-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-190-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-144-0x00000000048C0000-0x00000000048FA000-memory.dmp

    Filesize

    232KB

  • memory/2856-145-0x0000000007380000-0x0000000007390000-memory.dmp

    Filesize

    64KB

  • memory/2856-146-0x0000000007380000-0x0000000007390000-memory.dmp

    Filesize

    64KB

  • memory/2856-147-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-148-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-150-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-152-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-154-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-156-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-158-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-160-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-162-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-164-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-166-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-168-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-170-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-172-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-174-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-142-0x00000000047E0000-0x000000000481C000-memory.dmp

    Filesize

    240KB

  • memory/2856-178-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-180-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-182-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-184-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-186-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-188-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-143-0x0000000007390000-0x000000000788E000-memory.dmp

    Filesize

    5.0MB

  • memory/2856-192-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-194-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-196-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-198-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-200-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-202-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-204-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-206-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-208-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-210-0x00000000048C0000-0x00000000048F5000-memory.dmp

    Filesize

    212KB

  • memory/2856-939-0x0000000009D10000-0x000000000A316000-memory.dmp

    Filesize

    6.0MB

  • memory/2856-940-0x0000000004E20000-0x0000000004E32000-memory.dmp

    Filesize

    72KB

  • memory/2856-941-0x000000000A320000-0x000000000A42A000-memory.dmp

    Filesize

    1.0MB

  • memory/2856-942-0x00000000072B0000-0x00000000072EE000-memory.dmp

    Filesize

    248KB

  • memory/2856-943-0x0000000007330000-0x000000000737B000-memory.dmp

    Filesize

    300KB

  • memory/2856-944-0x0000000007380000-0x0000000007390000-memory.dmp

    Filesize

    64KB

  • memory/2856-945-0x000000000A670000-0x000000000A6D6000-memory.dmp

    Filesize

    408KB

  • memory/2856-946-0x000000000AD30000-0x000000000ADC2000-memory.dmp

    Filesize

    584KB

  • memory/2856-947-0x000000000ADF0000-0x000000000AE66000-memory.dmp

    Filesize

    472KB

  • memory/2856-948-0x000000000AEB0000-0x000000000B072000-memory.dmp

    Filesize

    1.8MB

  • memory/2856-141-0x0000000002BD0000-0x0000000002C16000-memory.dmp

    Filesize

    280KB

  • memory/2856-949-0x000000000B090000-0x000000000B5BC000-memory.dmp

    Filesize

    5.2MB

  • memory/2856-951-0x000000000B6F0000-0x000000000B70E000-memory.dmp

    Filesize

    120KB

  • memory/2856-952-0x0000000007380000-0x0000000007390000-memory.dmp

    Filesize

    64KB

  • memory/2856-953-0x0000000002F60000-0x0000000002FB0000-memory.dmp

    Filesize

    320KB