Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/04/2023, 05:39

General

  • Target

    0591cb0e4761ae3525cd71579378ee757411f1279205e8ca2ec48604cc59a97c.exe

  • Size

    700KB

  • MD5

    a60c651df93b4187b6b8790f4af1c56a

  • SHA1

    7545a23dffafbaa8914c81cdfba371da192ffc3e

  • SHA256

    0591cb0e4761ae3525cd71579378ee757411f1279205e8ca2ec48604cc59a97c

  • SHA512

    41dfb7b303c8641c0829d613696a034819ec80d143dc3a7a05d81261b05ff093cb99d75ebef72add35c562d3e99d4a38c1358b85e47070b6246646aeebf5eccb

  • SSDEEP

    12288:Vy90+6URh9O71tjn/Oi6koWOoyb7efvLFXbrCG2To9w1DClFDDXyPdxj:Vyd6Uqnn7r7WYpiGDwNOF2xj

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0591cb0e4761ae3525cd71579378ee757411f1279205e8ca2ec48604cc59a97c.exe
    "C:\Users\Admin\AppData\Local\Temp\0591cb0e4761ae3525cd71579378ee757411f1279205e8ca2ec48604cc59a97c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un087680.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un087680.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\40249885.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\40249885.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4220
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 1088
          4⤵
          • Program crash
          PID:2148
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878885.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878885.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:64
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 64 -s 1292
          4⤵
          • Program crash
          PID:4312
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si797154.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si797154.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4436
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4220 -ip 4220
    1⤵
      PID:1756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 64 -ip 64
      1⤵
        PID:2148

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si797154.exe

        Filesize

        136KB

        MD5

        b9f17cc95395f13838ba119abc3f742f

        SHA1

        ecdbc7ef78234c1c7009fdbc6f744c511067767d

        SHA256

        2e10845ea49bdd31991f80c88db940340e9f65c22eb3d1dc719e452fbcc17a15

        SHA512

        bf05c4b13405337bf71e69e8b751af742b24d47de2a46be74a5bb86d37e6eee099ef11d871e3514b1ee9c9458c1ac8127b6858eaae04dfced284d1ec87e34bca

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si797154.exe

        Filesize

        136KB

        MD5

        b9f17cc95395f13838ba119abc3f742f

        SHA1

        ecdbc7ef78234c1c7009fdbc6f744c511067767d

        SHA256

        2e10845ea49bdd31991f80c88db940340e9f65c22eb3d1dc719e452fbcc17a15

        SHA512

        bf05c4b13405337bf71e69e8b751af742b24d47de2a46be74a5bb86d37e6eee099ef11d871e3514b1ee9c9458c1ac8127b6858eaae04dfced284d1ec87e34bca

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un087680.exe

        Filesize

        546KB

        MD5

        e4f526ac78acce025e91e89f0913e4df

        SHA1

        d598a9c5693ad6284deea5a353b309268f4aedca

        SHA256

        9c365e488d620886b59f5c2373561697bdc1f8a92519bf1258a674d7ee1e238b

        SHA512

        3b46bcdefefeec9d9f1034d763f594582c378fb040322507f281d52c437f029286fe38b79797caf26f97814b0128f915f5ef340e2064dccdbab8b08868d9d9ad

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un087680.exe

        Filesize

        546KB

        MD5

        e4f526ac78acce025e91e89f0913e4df

        SHA1

        d598a9c5693ad6284deea5a353b309268f4aedca

        SHA256

        9c365e488d620886b59f5c2373561697bdc1f8a92519bf1258a674d7ee1e238b

        SHA512

        3b46bcdefefeec9d9f1034d763f594582c378fb040322507f281d52c437f029286fe38b79797caf26f97814b0128f915f5ef340e2064dccdbab8b08868d9d9ad

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\40249885.exe

        Filesize

        269KB

        MD5

        a7410f4fbb06094be68e707554b0e1ce

        SHA1

        42d901b3c5778f5f4422666260238c2eb812e73f

        SHA256

        e2172460893bcd1ce2d12aa0b721b4c09b5c5dceaefa503fe2367cfcc8648e47

        SHA512

        d743be49c02b95842fb804952266da654de0b31a7936a0c025b1cc061444f7649d59ba2c586c41f9200a5833cb837b16187afa5763df85c2b2ec84aad3fb35d9

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\40249885.exe

        Filesize

        269KB

        MD5

        a7410f4fbb06094be68e707554b0e1ce

        SHA1

        42d901b3c5778f5f4422666260238c2eb812e73f

        SHA256

        e2172460893bcd1ce2d12aa0b721b4c09b5c5dceaefa503fe2367cfcc8648e47

        SHA512

        d743be49c02b95842fb804952266da654de0b31a7936a0c025b1cc061444f7649d59ba2c586c41f9200a5833cb837b16187afa5763df85c2b2ec84aad3fb35d9

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878885.exe

        Filesize

        353KB

        MD5

        0d66112775fe549d096c2a9b3130eb52

        SHA1

        b756427c38a22966a9a9b672af0289109ae44e80

        SHA256

        0fb1f85e4fc6ec73df5fd2750c82f4705d6ba5e53ca4f7557dc8167bf1b7d098

        SHA512

        e9d192ff9356e1d830c4902f128b4e4cf628fda4b28b4b71629f70af05464b9e132efe4ce0fa45b8f2f6ff49e350587a1e598e2f1eebdcef95c5ec9b99b9087d

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878885.exe

        Filesize

        353KB

        MD5

        0d66112775fe549d096c2a9b3130eb52

        SHA1

        b756427c38a22966a9a9b672af0289109ae44e80

        SHA256

        0fb1f85e4fc6ec73df5fd2750c82f4705d6ba5e53ca4f7557dc8167bf1b7d098

        SHA512

        e9d192ff9356e1d830c4902f128b4e4cf628fda4b28b4b71629f70af05464b9e132efe4ce0fa45b8f2f6ff49e350587a1e598e2f1eebdcef95c5ec9b99b9087d

      • memory/64-982-0x0000000009C90000-0x000000000A2A8000-memory.dmp

        Filesize

        6.1MB

      • memory/64-983-0x000000000A310000-0x000000000A322000-memory.dmp

        Filesize

        72KB

      • memory/64-993-0x000000000B3D0000-0x000000000B8FC000-memory.dmp

        Filesize

        5.2MB

      • memory/64-992-0x000000000B200000-0x000000000B3C2000-memory.dmp

        Filesize

        1.8MB

      • memory/64-991-0x000000000AFF0000-0x000000000B00E000-memory.dmp

        Filesize

        120KB

      • memory/64-990-0x000000000AF30000-0x000000000AFA6000-memory.dmp

        Filesize

        472KB

      • memory/64-989-0x000000000AEC0000-0x000000000AF10000-memory.dmp

        Filesize

        320KB

      • memory/64-988-0x000000000AE10000-0x000000000AEA2000-memory.dmp

        Filesize

        584KB

      • memory/64-987-0x000000000A750000-0x000000000A7B6000-memory.dmp

        Filesize

        408KB

      • memory/64-986-0x00000000071D0000-0x00000000071E0000-memory.dmp

        Filesize

        64KB

      • memory/64-985-0x000000000A450000-0x000000000A48C000-memory.dmp

        Filesize

        240KB

      • memory/64-984-0x000000000A330000-0x000000000A43A000-memory.dmp

        Filesize

        1.0MB

      • memory/64-223-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-221-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-219-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-217-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-215-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-209-0x00000000071D0000-0x00000000071E0000-memory.dmp

        Filesize

        64KB

      • memory/64-187-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-186-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-189-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-191-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-193-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-195-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-197-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-199-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-201-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-204-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-203-0x0000000002BC0000-0x0000000002C06000-memory.dmp

        Filesize

        280KB

      • memory/64-207-0x00000000071D0000-0x00000000071E0000-memory.dmp

        Filesize

        64KB

      • memory/64-208-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-205-0x00000000071D0000-0x00000000071E0000-memory.dmp

        Filesize

        64KB

      • memory/64-211-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/64-213-0x0000000007790000-0x00000000077C5000-memory.dmp

        Filesize

        212KB

      • memory/4220-170-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-168-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-181-0x0000000000400000-0x0000000002B9E000-memory.dmp

        Filesize

        39.6MB

      • memory/4220-179-0x0000000000400000-0x0000000002B9E000-memory.dmp

        Filesize

        39.6MB

      • memory/4220-178-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-176-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-150-0x00000000071C0000-0x0000000007764000-memory.dmp

        Filesize

        5.6MB

      • memory/4220-154-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-174-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-166-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-152-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-151-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-172-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-164-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-162-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-160-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-158-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-156-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

        Filesize

        72KB

      • memory/4220-149-0x0000000002F60000-0x0000000002F70000-memory.dmp

        Filesize

        64KB

      • memory/4220-148-0x0000000002C70000-0x0000000002C9D000-memory.dmp

        Filesize

        180KB

      • memory/4436-1000-0x0000000000750000-0x0000000000778000-memory.dmp

        Filesize

        160KB

      • memory/4436-1001-0x0000000007530000-0x0000000007540000-memory.dmp

        Filesize

        64KB