Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24/04/2023, 10:56
Static task
static1
General
-
Target
cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe
-
Size
617KB
-
MD5
3877ea9c5db16e5cb8fbe131fae4f90d
-
SHA1
29f6a1e1a9e3d3ebd3fdca4916b8cbcc5a77ca89
-
SHA256
cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07
-
SHA512
dccd1ed1e9b20209d56c002c9d8fa3e84374e2dc96b570ffc6c422155f64a31e45cc45d69fdb8cd8a5350b1691076d1ad354294bebf8412919c271e4699161c4
-
SSDEEP
12288:8y90ORpZ53U2iTnQdKCsSPE3xdHxrWmTKpJz25sL:8ylRpj3iTnV3th5xZT2a5sL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 41766132.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 41766132.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 41766132.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 41766132.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 41766132.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 41766132.exe -
Executes dropped EXE 4 IoCs
pid Process 1588 st979320.exe 4412 41766132.exe 3232 kp692934.exe 4960 lr385474.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 41766132.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce st979320.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st979320.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4412 41766132.exe 4412 41766132.exe 3232 kp692934.exe 3232 kp692934.exe 4960 lr385474.exe 4960 lr385474.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4412 41766132.exe Token: SeDebugPrivilege 3232 kp692934.exe Token: SeDebugPrivilege 4960 lr385474.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1588 1640 cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe 84 PID 1640 wrote to memory of 1588 1640 cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe 84 PID 1640 wrote to memory of 1588 1640 cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe 84 PID 1588 wrote to memory of 4412 1588 st979320.exe 85 PID 1588 wrote to memory of 4412 1588 st979320.exe 85 PID 1588 wrote to memory of 3232 1588 st979320.exe 92 PID 1588 wrote to memory of 3232 1588 st979320.exe 92 PID 1588 wrote to memory of 3232 1588 st979320.exe 92 PID 1640 wrote to memory of 4960 1640 cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe 94 PID 1640 wrote to memory of 4960 1640 cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe 94 PID 1640 wrote to memory of 4960 1640 cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe"C:\Users\Admin\AppData\Local\Temp\cafdbd593f919c73d2a15b11f835ab2ac1806d79da766a93d14b418e7a0a3a07.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st979320.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st979320.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\41766132.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\41766132.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692934.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692934.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr385474.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr385474.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5ace73b2b1f835de11594ea9a243a9f5c
SHA12f929d1f69784fbe499a95b064679a16947bdd84
SHA2567310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49
SHA512024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e
-
Filesize
136KB
MD5ace73b2b1f835de11594ea9a243a9f5c
SHA12f929d1f69784fbe499a95b064679a16947bdd84
SHA2567310c28dc6a24530885da07d08c851b4a6c5aa987d2a44ce53cb73e72235fa49
SHA512024e1ce3ab37e27c8647d02f79c434e103a84265c97b4773aed1a0b1fd3e8228eab560fc9b6f53b0132575ea855d1da0cd0b6b6e5cd2965f841cf8551c7d138e
-
Filesize
463KB
MD5368fe2ca6d349f692423117f5a0a8f21
SHA16a78745b78dc7e22a6753ea52320d5318e903d87
SHA2564b9c07ca1c39b3e59a02d3f4ff138005de980d47d51150da97d7db3e504c126f
SHA512046a8bf8e9b2906aa29393ca912144b9cde4536ef21b2c5eacfe7ea4a2134232ef2fc86e3f5b59f0cf2e632ce75d815c1659f086963065b3dfd289aee46dafdd
-
Filesize
463KB
MD5368fe2ca6d349f692423117f5a0a8f21
SHA16a78745b78dc7e22a6753ea52320d5318e903d87
SHA2564b9c07ca1c39b3e59a02d3f4ff138005de980d47d51150da97d7db3e504c126f
SHA512046a8bf8e9b2906aa29393ca912144b9cde4536ef21b2c5eacfe7ea4a2134232ef2fc86e3f5b59f0cf2e632ce75d815c1659f086963065b3dfd289aee46dafdd
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
473KB
MD577d4ccce98092b495630b9056cd315ef
SHA1a64905c29cee07f9ee64da64d65d30f2efe98427
SHA2561ded094ba2359633d085db3548e38c51866ecb0aa91fb039d8e95dc5f992ce2b
SHA512a46363cfb365f1a3227f44380da25114690da9057a8a4a7208a1b95dfdf3bc9c548e4c9f3e5c9d33d052fe4c7c906b0fa0ee7b6d19a66c46ae332672088d2756
-
Filesize
473KB
MD577d4ccce98092b495630b9056cd315ef
SHA1a64905c29cee07f9ee64da64d65d30f2efe98427
SHA2561ded094ba2359633d085db3548e38c51866ecb0aa91fb039d8e95dc5f992ce2b
SHA512a46363cfb365f1a3227f44380da25114690da9057a8a4a7208a1b95dfdf3bc9c548e4c9f3e5c9d33d052fe4c7c906b0fa0ee7b6d19a66c46ae332672088d2756