Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 13:41

General

  • Target

    99b6b989a63dc530504c590690728de7d98a47be5ecbff83af94a678dd7e73e9.exe

  • Size

    566KB

  • MD5

    57927773fae0de2eb20e52a06106a8b5

  • SHA1

    772e71e185ba303d433cf843a2a2a4340e3ae593

  • SHA256

    99b6b989a63dc530504c590690728de7d98a47be5ecbff83af94a678dd7e73e9

  • SHA512

    ed0d056ee660fd11a8f210e7761a372f2796efa078c5bf1c41dafbc28ffad5a6c45c8c1a594b2a1098a7de44388d651dab32fb5ce8fc9a28d4d80e84ac11a651

  • SSDEEP

    12288:Wy905uLgFSiNYDTmVUZmzdx36osHP78go3rxy:Wy+SiyDTmV9HlsggGU

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99b6b989a63dc530504c590690728de7d98a47be5ecbff83af94a678dd7e73e9.exe
    "C:\Users\Admin\AppData\Local\Temp\99b6b989a63dc530504c590690728de7d98a47be5ecbff83af94a678dd7e73e9.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJb4810.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJb4810.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3252
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it391791.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it391791.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2116
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp485623.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp485623.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4536
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 1316
          4⤵
          • Program crash
          PID:2040
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069860.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069860.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2340
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4536 -ip 4536
    1⤵
      PID:988

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069860.exe

      Filesize

      136KB

      MD5

      8c80b06d843bd6a7599a5be2075d9a55

      SHA1

      caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

      SHA256

      e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

      SHA512

      cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr069860.exe

      Filesize

      136KB

      MD5

      8c80b06d843bd6a7599a5be2075d9a55

      SHA1

      caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

      SHA256

      e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

      SHA512

      cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJb4810.exe

      Filesize

      412KB

      MD5

      6ae18d97b7bb8316e2cdbf9e41919cd1

      SHA1

      bbe5e7f7d6583a28d7490388b539fef6bac78876

      SHA256

      a29ee1042fb4394615054b88f3d65f1368f3be43ea739f05df8ead78144854df

      SHA512

      55124f729a368ab28e52018f38277e7fe0701230cf87b5c8a6cc89680242fd90414ec9c037855bbaf84500dc746ef165c8f4ad217626e1eb253ec26b4ae3da83

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJb4810.exe

      Filesize

      412KB

      MD5

      6ae18d97b7bb8316e2cdbf9e41919cd1

      SHA1

      bbe5e7f7d6583a28d7490388b539fef6bac78876

      SHA256

      a29ee1042fb4394615054b88f3d65f1368f3be43ea739f05df8ead78144854df

      SHA512

      55124f729a368ab28e52018f38277e7fe0701230cf87b5c8a6cc89680242fd90414ec9c037855bbaf84500dc746ef165c8f4ad217626e1eb253ec26b4ae3da83

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it391791.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it391791.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp485623.exe

      Filesize

      369KB

      MD5

      e133744c45a1f140359a0ed8a58b1355

      SHA1

      20c9ff7f90e333719cf99bb77a642c982a182f5c

      SHA256

      1d063b5951496d9c4f7b06afed55b25183f167e1c7c3e237164edb656e11d514

      SHA512

      e9da8b7d1b5234c97ade304245850cc1dd00a0f22caa05a8c2af1c8e809784f24531ae9d3683d23db3932342db9cb335c239709db53b850b6d9b10eb9df516ab

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp485623.exe

      Filesize

      369KB

      MD5

      e133744c45a1f140359a0ed8a58b1355

      SHA1

      20c9ff7f90e333719cf99bb77a642c982a182f5c

      SHA256

      1d063b5951496d9c4f7b06afed55b25183f167e1c7c3e237164edb656e11d514

      SHA512

      e9da8b7d1b5234c97ade304245850cc1dd00a0f22caa05a8c2af1c8e809784f24531ae9d3683d23db3932342db9cb335c239709db53b850b6d9b10eb9df516ab

    • memory/2116-147-0x00000000007E0000-0x00000000007EA000-memory.dmp

      Filesize

      40KB

    • memory/2340-968-0x0000000000780000-0x00000000007A8000-memory.dmp

      Filesize

      160KB

    • memory/2340-969-0x0000000007810000-0x0000000007820000-memory.dmp

      Filesize

      64KB

    • memory/4536-185-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-197-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-155-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/4536-156-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/4536-157-0x00000000072D0000-0x0000000007874000-memory.dmp

      Filesize

      5.6MB

    • memory/4536-158-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-159-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-161-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-163-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-165-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-167-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-169-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-171-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-173-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-175-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-177-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-179-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-181-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-183-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-153-0x0000000002C10000-0x0000000002C56000-memory.dmp

      Filesize

      280KB

    • memory/4536-187-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-189-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-191-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-193-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-195-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-154-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/4536-199-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-201-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-203-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-205-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-207-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-209-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-211-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-213-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-215-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-217-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-219-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-221-0x0000000004D20000-0x0000000004D55000-memory.dmp

      Filesize

      212KB

    • memory/4536-950-0x0000000009D00000-0x000000000A318000-memory.dmp

      Filesize

      6.1MB

    • memory/4536-951-0x000000000A320000-0x000000000A332000-memory.dmp

      Filesize

      72KB

    • memory/4536-952-0x000000000A340000-0x000000000A44A000-memory.dmp

      Filesize

      1.0MB

    • memory/4536-953-0x000000000A4A0000-0x000000000A4DC000-memory.dmp

      Filesize

      240KB

    • memory/4536-954-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/4536-955-0x000000000A760000-0x000000000A7C6000-memory.dmp

      Filesize

      408KB

    • memory/4536-956-0x000000000AE30000-0x000000000AEC2000-memory.dmp

      Filesize

      584KB

    • memory/4536-957-0x000000000AEF0000-0x000000000AF66000-memory.dmp

      Filesize

      472KB

    • memory/4536-958-0x000000000AFD0000-0x000000000B192000-memory.dmp

      Filesize

      1.8MB

    • memory/4536-959-0x000000000B1A0000-0x000000000B6CC000-memory.dmp

      Filesize

      5.2MB

    • memory/4536-960-0x000000000B7F0000-0x000000000B80E000-memory.dmp

      Filesize

      120KB

    • memory/4536-961-0x0000000004770000-0x00000000047C0000-memory.dmp

      Filesize

      320KB