Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    72s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24/04/2023, 03:22

General

  • Target

    d19398603b7530a61656d2150717581dc492573e57d951aba483050469f252ef.exe

  • Size

    562KB

  • MD5

    2db294bb622eaaa284eac12bfbbd44cb

  • SHA1

    41758961830ed7f6677616416bef81324edfc80a

  • SHA256

    d19398603b7530a61656d2150717581dc492573e57d951aba483050469f252ef

  • SHA512

    de0dd3e0a795e5ec88f4de5f34665741b327e03237e074a46ce71ed2c5a9c25b50e9f2a240c8a710bbfdc505a07a25f2c1e161f9d1b3576fe380d0d86f381584

  • SSDEEP

    12288:ry90iZpOzNlfTh83A1pRgTMDPotII37hmN+rDo5Sp:ryBZpovfIamwDwthg54

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d19398603b7530a61656d2150717581dc492573e57d951aba483050469f252ef.exe
    "C:\Users\Admin\AppData\Local\Temp\d19398603b7530a61656d2150717581dc492573e57d951aba483050469f252ef.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st318251.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st318251.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3540
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\39758616.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\39758616.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4672
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp775630.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp775630.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1420
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr237936.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr237936.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2488

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr237936.exe

    Filesize

    136KB

    MD5

    ace73b2b1f835de11594ea9a243a9f5c

    SHA1

    2f929d1f69784fbe499a95b064679a16947bdd84

    SHA256

    7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

    SHA512

    024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr237936.exe

    Filesize

    136KB

    MD5

    ace73b2b1f835de11594ea9a243a9f5c

    SHA1

    2f929d1f69784fbe499a95b064679a16947bdd84

    SHA256

    7310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49

    SHA512

    024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st318251.exe

    Filesize

    408KB

    MD5

    dbb71cad548682181ac27a01bc348b91

    SHA1

    118ae73e4222bde6ef84b532b055eedcb742cb7e

    SHA256

    2d157420af8848a425129b1fdddcf035fcf9ed0d3e954e94dc710c739f8f4734

    SHA512

    f282d29f96fbbd4c561fa9707a0f442d196ebd0e8255fa25dcb702398ce903dcfe04841a4219e6ee2782416a842dc0ce29a96c7418afdcae4a633a9c18d85a03

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st318251.exe

    Filesize

    408KB

    MD5

    dbb71cad548682181ac27a01bc348b91

    SHA1

    118ae73e4222bde6ef84b532b055eedcb742cb7e

    SHA256

    2d157420af8848a425129b1fdddcf035fcf9ed0d3e954e94dc710c739f8f4734

    SHA512

    f282d29f96fbbd4c561fa9707a0f442d196ebd0e8255fa25dcb702398ce903dcfe04841a4219e6ee2782416a842dc0ce29a96c7418afdcae4a633a9c18d85a03

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\39758616.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\39758616.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp775630.exe

    Filesize

    360KB

    MD5

    cb19951f18090d666fa9cebf831d9592

    SHA1

    6172a07f2e9918f4da54307e5eadc09e45649c0d

    SHA256

    5035658b37976fa0055e2c486a021afbc1e1a4c56029f43572e9b1313c48f576

    SHA512

    988f98903c75699e557c1e95c3b03e368341e55205b7b15a3e804d110c88916ae184b84993de1dfacd21128c357c73a1350efb9dde93d6483041d18c921445b4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp775630.exe

    Filesize

    360KB

    MD5

    cb19951f18090d666fa9cebf831d9592

    SHA1

    6172a07f2e9918f4da54307e5eadc09e45649c0d

    SHA256

    5035658b37976fa0055e2c486a021afbc1e1a4c56029f43572e9b1313c48f576

    SHA512

    988f98903c75699e557c1e95c3b03e368341e55205b7b15a3e804d110c88916ae184b84993de1dfacd21128c357c73a1350efb9dde93d6483041d18c921445b4

  • memory/1420-137-0x0000000004860000-0x000000000489C000-memory.dmp

    Filesize

    240KB

  • memory/1420-138-0x0000000007280000-0x000000000777E000-memory.dmp

    Filesize

    5.0MB

  • memory/1420-139-0x0000000004C60000-0x0000000004C9A000-memory.dmp

    Filesize

    232KB

  • memory/1420-140-0x0000000002CA0000-0x0000000002CE6000-memory.dmp

    Filesize

    280KB

  • memory/1420-142-0x0000000004CF0000-0x0000000004D00000-memory.dmp

    Filesize

    64KB

  • memory/1420-141-0x0000000004CF0000-0x0000000004D00000-memory.dmp

    Filesize

    64KB

  • memory/1420-143-0x0000000004CF0000-0x0000000004D00000-memory.dmp

    Filesize

    64KB

  • memory/1420-145-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-144-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-147-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-149-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-151-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-155-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-157-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-153-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-159-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-161-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-163-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-165-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-167-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-169-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-171-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-173-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-175-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-177-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-179-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-181-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-183-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-185-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-187-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-189-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-191-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-193-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-195-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-197-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-199-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-201-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-203-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-205-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-207-0x0000000004C60000-0x0000000004C95000-memory.dmp

    Filesize

    212KB

  • memory/1420-936-0x0000000009C00000-0x000000000A206000-memory.dmp

    Filesize

    6.0MB

  • memory/1420-937-0x0000000004D00000-0x0000000004D12000-memory.dmp

    Filesize

    72KB

  • memory/1420-938-0x000000000A250000-0x000000000A35A000-memory.dmp

    Filesize

    1.0MB

  • memory/1420-939-0x000000000A360000-0x000000000A39E000-memory.dmp

    Filesize

    248KB

  • memory/1420-940-0x000000000A3E0000-0x000000000A42B000-memory.dmp

    Filesize

    300KB

  • memory/1420-941-0x0000000004CF0000-0x0000000004D00000-memory.dmp

    Filesize

    64KB

  • memory/1420-942-0x000000000A670000-0x000000000A6D6000-memory.dmp

    Filesize

    408KB

  • memory/1420-943-0x000000000AD20000-0x000000000ADB2000-memory.dmp

    Filesize

    584KB

  • memory/1420-944-0x000000000AEF0000-0x000000000AF66000-memory.dmp

    Filesize

    472KB

  • memory/1420-945-0x000000000AFB0000-0x000000000B172000-memory.dmp

    Filesize

    1.8MB

  • memory/1420-946-0x000000000B190000-0x000000000B6BC000-memory.dmp

    Filesize

    5.2MB

  • memory/1420-947-0x000000000B7E0000-0x000000000B7FE000-memory.dmp

    Filesize

    120KB

  • memory/1420-948-0x0000000004A80000-0x0000000004AD0000-memory.dmp

    Filesize

    320KB

  • memory/2488-954-0x00000000007B0000-0x00000000007D8000-memory.dmp

    Filesize

    160KB

  • memory/2488-955-0x0000000007570000-0x00000000075BB000-memory.dmp

    Filesize

    300KB

  • memory/2488-956-0x0000000007560000-0x0000000007570000-memory.dmp

    Filesize

    64KB

  • memory/4672-131-0x0000000000F10000-0x0000000000F1A000-memory.dmp

    Filesize

    40KB