Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    83s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/04/2023, 18:37

General

  • Target

    0ddd2e61d94f2dda4929887701067020c066c5487b8f25e04e65173fbb92ef40.exe

  • Size

    562KB

  • MD5

    93d813664ebb81dd50757bea17860274

  • SHA1

    763bb9b9e27079f9cfa44f7a6108652be5badeee

  • SHA256

    0ddd2e61d94f2dda4929887701067020c066c5487b8f25e04e65173fbb92ef40

  • SHA512

    eca8aef508d5918fa146d291793f454d6adf008094022eeadafa9c61b0fed331042b996d4164c22c2b4fd36bdba5d5d4b4e922f53b5a51163a5e19d1f84b1e7e

  • SSDEEP

    12288:Ty9032oCRu3wH8XEfopBPL0rbeaxjarqSVUhMl:Ty6gugcXEfiBaqoerqSVl

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ddd2e61d94f2dda4929887701067020c066c5487b8f25e04e65173fbb92ef40.exe
    "C:\Users\Admin\AppData\Local\Temp\0ddd2e61d94f2dda4929887701067020c066c5487b8f25e04e65173fbb92ef40.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4484
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHP8930.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHP8930.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3196
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it895822.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it895822.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4164
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp826273.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp826273.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3172
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 2116
          4⤵
          • Program crash
          PID:3864
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr668428.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr668428.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:488
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3172 -ip 3172
    1⤵
      PID:2792

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr668428.exe

      Filesize

      136KB

      MD5

      8c80b06d843bd6a7599a5be2075d9a55

      SHA1

      caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

      SHA256

      e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

      SHA512

      cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr668428.exe

      Filesize

      136KB

      MD5

      8c80b06d843bd6a7599a5be2075d9a55

      SHA1

      caf86cf2f908f6ac64b8d4788bc61aaaf672f9f2

      SHA256

      e794f573618cef6be742a0f574f179aa1087b51c4ec23bcf7faa16415028850e

      SHA512

      cd902bd2607ee797a60f615c550304e45ff59f2313cbb596b50fae913eae481987a8bde0a83587b153192eeb97514f281864c5fb3db4dc128453d507c5aeeded

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHP8930.exe

      Filesize

      409KB

      MD5

      dcc2845001dd4bb4ad264541d8585cb7

      SHA1

      387b57d003595ddf4587ad002d37b742a45ba6ef

      SHA256

      c49fea6d66c53c837841d332185a61a71be2de4f11d3b3fc4736ccf99a89c490

      SHA512

      2d03d15ebbbc77d6a252e55815fdd61630b350ce228a02a9b106fa0bb6991f507b471b7395f4d6ec77fe5b31a06fe24f642267127a57e0a391f18cfa33be39e9

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziHP8930.exe

      Filesize

      409KB

      MD5

      dcc2845001dd4bb4ad264541d8585cb7

      SHA1

      387b57d003595ddf4587ad002d37b742a45ba6ef

      SHA256

      c49fea6d66c53c837841d332185a61a71be2de4f11d3b3fc4736ccf99a89c490

      SHA512

      2d03d15ebbbc77d6a252e55815fdd61630b350ce228a02a9b106fa0bb6991f507b471b7395f4d6ec77fe5b31a06fe24f642267127a57e0a391f18cfa33be39e9

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it895822.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it895822.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp826273.exe

      Filesize

      360KB

      MD5

      467a54f502867409778cdef96c874c4d

      SHA1

      ed032092e1a3d703c8b30d2499e516ed478722a5

      SHA256

      f1a3d4c9a12c01ef5e21084de646729d9dbf5fb53ece8663ebbd3593d439f275

      SHA512

      6b6fff9dcd258d7eaf0f0afe219518babc356b6b1925e22bfa34f6650cbb5cb53e1ab2c4bc774444aa9476e39958952c9a5858e3fafdcc49eebb1c47ed964c62

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp826273.exe

      Filesize

      360KB

      MD5

      467a54f502867409778cdef96c874c4d

      SHA1

      ed032092e1a3d703c8b30d2499e516ed478722a5

      SHA256

      f1a3d4c9a12c01ef5e21084de646729d9dbf5fb53ece8663ebbd3593d439f275

      SHA512

      6b6fff9dcd258d7eaf0f0afe219518babc356b6b1925e22bfa34f6650cbb5cb53e1ab2c4bc774444aa9476e39958952c9a5858e3fafdcc49eebb1c47ed964c62

    • memory/488-972-0x00000000002B0000-0x00000000002D8000-memory.dmp

      Filesize

      160KB

    • memory/488-973-0x0000000007040000-0x0000000007050000-memory.dmp

      Filesize

      64KB

    • memory/3172-193-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-203-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-156-0x00000000075D0000-0x00000000075E0000-memory.dmp

      Filesize

      64KB

    • memory/3172-157-0x00000000075D0000-0x00000000075E0000-memory.dmp

      Filesize

      64KB

    • memory/3172-158-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-161-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-159-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-163-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-165-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-167-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-169-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-171-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-173-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-175-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-177-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-179-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-181-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-183-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-185-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-187-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-189-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-191-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-154-0x0000000002BD0000-0x0000000002C16000-memory.dmp

      Filesize

      280KB

    • memory/3172-195-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-197-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-199-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-201-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-155-0x00000000075D0000-0x00000000075E0000-memory.dmp

      Filesize

      64KB

    • memory/3172-205-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-207-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-209-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-211-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-213-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-215-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-217-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-219-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-221-0x0000000004C50000-0x0000000004C85000-memory.dmp

      Filesize

      212KB

    • memory/3172-950-0x0000000009F10000-0x000000000A528000-memory.dmp

      Filesize

      6.1MB

    • memory/3172-951-0x0000000007500000-0x0000000007512000-memory.dmp

      Filesize

      72KB

    • memory/3172-952-0x000000000A530000-0x000000000A63A000-memory.dmp

      Filesize

      1.0MB

    • memory/3172-953-0x0000000007530000-0x000000000756C000-memory.dmp

      Filesize

      240KB

    • memory/3172-954-0x00000000075D0000-0x00000000075E0000-memory.dmp

      Filesize

      64KB

    • memory/3172-956-0x00000000075D0000-0x00000000075E0000-memory.dmp

      Filesize

      64KB

    • memory/3172-957-0x00000000075D0000-0x00000000075E0000-memory.dmp

      Filesize

      64KB

    • memory/3172-958-0x00000000075D0000-0x00000000075E0000-memory.dmp

      Filesize

      64KB

    • memory/3172-959-0x000000000A8A0000-0x000000000A906000-memory.dmp

      Filesize

      408KB

    • memory/3172-960-0x000000000AF70000-0x000000000B002000-memory.dmp

      Filesize

      584KB

    • memory/3172-961-0x000000000B120000-0x000000000B170000-memory.dmp

      Filesize

      320KB

    • memory/3172-962-0x00000000075D0000-0x00000000075E0000-memory.dmp

      Filesize

      64KB

    • memory/3172-963-0x000000000B180000-0x000000000B1F6000-memory.dmp

      Filesize

      472KB

    • memory/3172-153-0x00000000075E0000-0x0000000007B84000-memory.dmp

      Filesize

      5.6MB

    • memory/3172-964-0x000000000B370000-0x000000000B38E000-memory.dmp

      Filesize

      120KB

    • memory/3172-965-0x000000000B450000-0x000000000B612000-memory.dmp

      Filesize

      1.8MB

    • memory/3172-966-0x000000000B620000-0x000000000BB4C000-memory.dmp

      Filesize

      5.2MB

    • memory/4164-147-0x0000000000110000-0x000000000011A000-memory.dmp

      Filesize

      40KB