Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    62s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/04/2023, 03:39

General

  • Target

    3d1cba5c8fe9cfa6d8d906db8804fc47d831c4c075af2a98b5b91a6bb506c689.exe

  • Size

    746KB

  • MD5

    e5974f2bd53dada43315897b7c694400

  • SHA1

    995bfd4cd02a73bda54a534cb86ac08fb5f3a038

  • SHA256

    3d1cba5c8fe9cfa6d8d906db8804fc47d831c4c075af2a98b5b91a6bb506c689

  • SHA512

    4831760f789a12c18f257d4b548f2748a68fbc2b04b07d1511d22bcede80736f515850f329ec5bffefdc87068d9e05f0fb894203d3a3e60f68ecdeb3dcb612c4

  • SSDEEP

    12288:uy90yejPqj4YKMQSZEZZKDhvapvYEu4B+k6BVYm9yIBtQXROsVgJqR0N:uyWSjNKMAZ0GYbloYQXNVoqm

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d1cba5c8fe9cfa6d8d906db8804fc47d831c4c075af2a98b5b91a6bb506c689.exe
    "C:\Users\Admin\AppData\Local\Temp\3d1cba5c8fe9cfa6d8d906db8804fc47d831c4c075af2a98b5b91a6bb506c689.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un573390.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un573390.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84593723.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84593723.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2176
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 1084
          4⤵
          • Program crash
          PID:3904
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk031604.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk031604.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3760
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 1320
          4⤵
          • Program crash
          PID:2040
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si701920.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si701920.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4816
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2176 -ip 2176
    1⤵
      PID:3796
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3760 -ip 3760
      1⤵
        PID:3240

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si701920.exe

        Filesize

        136KB

        MD5

        b9f17cc95395f13838ba119abc3f742f

        SHA1

        ecdbc7ef78234c1c7009fdbc6f744c511067767d

        SHA256

        2e10845ea49bdd31991f80c88db940340e9f65c22eb3d1dc719e452fbcc17a15

        SHA512

        bf05c4b13405337bf71e69e8b751af742b24d47de2a46be74a5bb86d37e6eee099ef11d871e3514b1ee9c9458c1ac8127b6858eaae04dfced284d1ec87e34bca

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si701920.exe

        Filesize

        136KB

        MD5

        b9f17cc95395f13838ba119abc3f742f

        SHA1

        ecdbc7ef78234c1c7009fdbc6f744c511067767d

        SHA256

        2e10845ea49bdd31991f80c88db940340e9f65c22eb3d1dc719e452fbcc17a15

        SHA512

        bf05c4b13405337bf71e69e8b751af742b24d47de2a46be74a5bb86d37e6eee099ef11d871e3514b1ee9c9458c1ac8127b6858eaae04dfced284d1ec87e34bca

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un573390.exe

        Filesize

        592KB

        MD5

        4822efbbdbe620c0080ac4abe837f2a4

        SHA1

        df5e3766446ed0ed6a6cc96198b1d32060ddc44b

        SHA256

        23a11074e33228d190515e85ca0e6c9c77b8725511441eb25870f20a903799ee

        SHA512

        0bab4fc75bc9ae1b7877bb8952c6bb210193e10dfa51b50b93827c0a99d84ac0493d43d2274ee88c36f61a37f9ca669c28d4c456599e023deca1f3c4fafb4245

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un573390.exe

        Filesize

        592KB

        MD5

        4822efbbdbe620c0080ac4abe837f2a4

        SHA1

        df5e3766446ed0ed6a6cc96198b1d32060ddc44b

        SHA256

        23a11074e33228d190515e85ca0e6c9c77b8725511441eb25870f20a903799ee

        SHA512

        0bab4fc75bc9ae1b7877bb8952c6bb210193e10dfa51b50b93827c0a99d84ac0493d43d2274ee88c36f61a37f9ca669c28d4c456599e023deca1f3c4fafb4245

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84593723.exe

        Filesize

        376KB

        MD5

        ddd6cf90f594271b84767b4080abf59e

        SHA1

        640f1b775792a2c9efe270fbfbc2151247bb7e0b

        SHA256

        04c3d89b6dfcb2e0016a2ab92e5e659ae2054de05eb2a2355545dbe4371a3094

        SHA512

        36807c075253f9b048a6e52b605e774e84ef323b4c310c83378ad56e785516d234729c534b9315aff01148b76c31321eb6503d845769d05bdff12e6c8c8eecab

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84593723.exe

        Filesize

        376KB

        MD5

        ddd6cf90f594271b84767b4080abf59e

        SHA1

        640f1b775792a2c9efe270fbfbc2151247bb7e0b

        SHA256

        04c3d89b6dfcb2e0016a2ab92e5e659ae2054de05eb2a2355545dbe4371a3094

        SHA512

        36807c075253f9b048a6e52b605e774e84ef323b4c310c83378ad56e785516d234729c534b9315aff01148b76c31321eb6503d845769d05bdff12e6c8c8eecab

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk031604.exe

        Filesize

        459KB

        MD5

        ddb6f480aa4db96f43102b7d64ac308d

        SHA1

        739cfbadc2541fb1e6771969762bafb528ea4134

        SHA256

        fdfffe42b5db4128da66c8be3a06b1fdc2a650a50863879b945af48469b53bbc

        SHA512

        b7b7bc0aa31368dea9ccd6e9b4f2ebf6dd9e8fc25bb2aa3ecad436dffd3d0c9c142f6558992fe3afedaeb672e084241be458796c1e7d07b4675b91448d8d2f0a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk031604.exe

        Filesize

        459KB

        MD5

        ddb6f480aa4db96f43102b7d64ac308d

        SHA1

        739cfbadc2541fb1e6771969762bafb528ea4134

        SHA256

        fdfffe42b5db4128da66c8be3a06b1fdc2a650a50863879b945af48469b53bbc

        SHA512

        b7b7bc0aa31368dea9ccd6e9b4f2ebf6dd9e8fc25bb2aa3ecad436dffd3d0c9c142f6558992fe3afedaeb672e084241be458796c1e7d07b4675b91448d8d2f0a

      • memory/2176-148-0x0000000004FE0000-0x0000000005584000-memory.dmp

        Filesize

        5.6MB

      • memory/2176-149-0x00000000008E0000-0x000000000090D000-memory.dmp

        Filesize

        180KB

      • memory/2176-150-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

        Filesize

        64KB

      • memory/2176-151-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

        Filesize

        64KB

      • memory/2176-152-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-153-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-155-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-157-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-159-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-161-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-163-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-165-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-167-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-169-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-171-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-173-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-175-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-177-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-179-0x0000000002A80000-0x0000000002A92000-memory.dmp

        Filesize

        72KB

      • memory/2176-180-0x0000000000400000-0x0000000000803000-memory.dmp

        Filesize

        4.0MB

      • memory/2176-181-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

        Filesize

        64KB

      • memory/2176-182-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

        Filesize

        64KB

      • memory/2176-183-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

        Filesize

        64KB

      • memory/2176-185-0x0000000000400000-0x0000000000803000-memory.dmp

        Filesize

        4.0MB

      • memory/3760-190-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-191-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-193-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-195-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-197-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-199-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-201-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-203-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-205-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-207-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-209-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-211-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-213-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-215-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-218-0x0000000000A00000-0x0000000000A46000-memory.dmp

        Filesize

        280KB

      • memory/3760-217-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-221-0x0000000004C80000-0x0000000004C90000-memory.dmp

        Filesize

        64KB

      • memory/3760-222-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-220-0x0000000004C80000-0x0000000004C90000-memory.dmp

        Filesize

        64KB

      • memory/3760-225-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-223-0x0000000004C80000-0x0000000004C90000-memory.dmp

        Filesize

        64KB

      • memory/3760-227-0x0000000005380000-0x00000000053B5000-memory.dmp

        Filesize

        212KB

      • memory/3760-986-0x00000000078B0000-0x0000000007EC8000-memory.dmp

        Filesize

        6.1MB

      • memory/3760-987-0x0000000007F70000-0x0000000007F82000-memory.dmp

        Filesize

        72KB

      • memory/3760-988-0x0000000007F90000-0x000000000809A000-memory.dmp

        Filesize

        1.0MB

      • memory/3760-989-0x00000000080B0000-0x00000000080EC000-memory.dmp

        Filesize

        240KB

      • memory/3760-990-0x0000000004C80000-0x0000000004C90000-memory.dmp

        Filesize

        64KB

      • memory/3760-991-0x00000000083B0000-0x0000000008416000-memory.dmp

        Filesize

        408KB

      • memory/3760-992-0x0000000008A80000-0x0000000008B12000-memory.dmp

        Filesize

        584KB

      • memory/3760-993-0x0000000008B40000-0x0000000008BB6000-memory.dmp

        Filesize

        472KB

      • memory/3760-994-0x0000000008C20000-0x0000000008DE2000-memory.dmp

        Filesize

        1.8MB

      • memory/3760-995-0x0000000008DF0000-0x000000000931C000-memory.dmp

        Filesize

        5.2MB

      • memory/3760-996-0x0000000009430000-0x000000000944E000-memory.dmp

        Filesize

        120KB

      • memory/3760-997-0x00000000046E0000-0x0000000004730000-memory.dmp

        Filesize

        320KB

      • memory/4816-1003-0x0000000000710000-0x0000000000738000-memory.dmp

        Filesize

        160KB

      • memory/4816-1004-0x00000000077A0000-0x00000000077B0000-memory.dmp

        Filesize

        64KB