Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    98s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/04/2023, 05:58

General

  • Target

    78ce8fb313e4d504c8987f19ff57b434f3673437c51aff121ca07286feb6552a.exe

  • Size

    701KB

  • MD5

    20893eab8201e5ee1a02927d50cd835e

  • SHA1

    7887d946de1e76746fecc338e6cd5d265045597e

  • SHA256

    78ce8fb313e4d504c8987f19ff57b434f3673437c51aff121ca07286feb6552a

  • SHA512

    4d726e18cc94b156d7e36d0b6adbb1853a92f42f48e482c30e996b6ce44b7f1f4af183e778ac7e16b4bb0228c63495195aa498e5070ac8639b50acd6a542f929

  • SSDEEP

    12288:9y90IL2bOi/cXXv/qjTYF541KZ0fCLk4c8Xf1M913kyEG28o9wa9wNVGl5PzanB8:9yabOlHHwTPKZHfcaGuwesiGRG

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78ce8fb313e4d504c8987f19ff57b434f3673437c51aff121ca07286feb6552a.exe
    "C:\Users\Admin\AppData\Local\Temp\78ce8fb313e4d504c8987f19ff57b434f3673437c51aff121ca07286feb6552a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:984
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un587100.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un587100.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1160
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\80104994.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\80104994.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1232
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 1092
          4⤵
          • Program crash
          PID:4272
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk920919.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk920919.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:228
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 1592
          4⤵
          • Program crash
          PID:2652
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si543672.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si543672.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1420
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1232 -ip 1232
    1⤵
      PID:1744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 228 -ip 228
      1⤵
        PID:1112

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si543672.exe

        Filesize

        136KB

        MD5

        b9f17cc95395f13838ba119abc3f742f

        SHA1

        ecdbc7ef78234c1c7009fdbc6f744c511067767d

        SHA256

        2e10845ea49bdd31991f80c88db940340e9f65c22eb3d1dc719e452fbcc17a15

        SHA512

        bf05c4b13405337bf71e69e8b751af742b24d47de2a46be74a5bb86d37e6eee099ef11d871e3514b1ee9c9458c1ac8127b6858eaae04dfced284d1ec87e34bca

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si543672.exe

        Filesize

        136KB

        MD5

        b9f17cc95395f13838ba119abc3f742f

        SHA1

        ecdbc7ef78234c1c7009fdbc6f744c511067767d

        SHA256

        2e10845ea49bdd31991f80c88db940340e9f65c22eb3d1dc719e452fbcc17a15

        SHA512

        bf05c4b13405337bf71e69e8b751af742b24d47de2a46be74a5bb86d37e6eee099ef11d871e3514b1ee9c9458c1ac8127b6858eaae04dfced284d1ec87e34bca

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un587100.exe

        Filesize

        547KB

        MD5

        0a9f8d698184de3f290cd5367c33f7f8

        SHA1

        f82440457d35dacd4877503775bd6a76064f06e5

        SHA256

        d2ba2aaa5b4461f9f85ce8de10b0d4878ff79d65e2cba49461bb39e386537d26

        SHA512

        7b34dec8f96f179436d86a5d92cc0add59e25c766a5b2f0f4356ec241eaa1f3fd19c7d104d36b695953fbceaa52ed975d322f343913dc133eb250b41cf5b103f

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un587100.exe

        Filesize

        547KB

        MD5

        0a9f8d698184de3f290cd5367c33f7f8

        SHA1

        f82440457d35dacd4877503775bd6a76064f06e5

        SHA256

        d2ba2aaa5b4461f9f85ce8de10b0d4878ff79d65e2cba49461bb39e386537d26

        SHA512

        7b34dec8f96f179436d86a5d92cc0add59e25c766a5b2f0f4356ec241eaa1f3fd19c7d104d36b695953fbceaa52ed975d322f343913dc133eb250b41cf5b103f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\80104994.exe

        Filesize

        269KB

        MD5

        da1263bdee4640065bd7fb242fd4ff7a

        SHA1

        a10f40756cf85cf29578c8031bec465db0b9218a

        SHA256

        79fe6d1553b2797361ee9386a17d6ae304585b75c8e8ec27bb0763ade69045ff

        SHA512

        cd07a5f600e9f2066fbae16101f16989cb5660729c96a06cf8fe45a175810d8104773051102bace5e3d1ebb92e1c137c8446c3148ef5e0838e410e5e76c4294e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\80104994.exe

        Filesize

        269KB

        MD5

        da1263bdee4640065bd7fb242fd4ff7a

        SHA1

        a10f40756cf85cf29578c8031bec465db0b9218a

        SHA256

        79fe6d1553b2797361ee9386a17d6ae304585b75c8e8ec27bb0763ade69045ff

        SHA512

        cd07a5f600e9f2066fbae16101f16989cb5660729c96a06cf8fe45a175810d8104773051102bace5e3d1ebb92e1c137c8446c3148ef5e0838e410e5e76c4294e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk920919.exe

        Filesize

        353KB

        MD5

        12aa1abe87beabe7dc37be101d2fc9cb

        SHA1

        6e9628df0a40decd9e0fe895c8aececb19cba790

        SHA256

        10188a8c805c77d9b54dd1651feb294f14d6ce0329e3f458473a326a1486a32e

        SHA512

        4d5af7e0738a421451694ee3e66cccd01452396e4acecde4a85b57a981ee74f521fd8bc03329e6f0e30f029d27548b7dca3044f97c8f3fa6242a8f5df583de90

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk920919.exe

        Filesize

        353KB

        MD5

        12aa1abe87beabe7dc37be101d2fc9cb

        SHA1

        6e9628df0a40decd9e0fe895c8aececb19cba790

        SHA256

        10188a8c805c77d9b54dd1651feb294f14d6ce0329e3f458473a326a1486a32e

        SHA512

        4d5af7e0738a421451694ee3e66cccd01452396e4acecde4a85b57a981ee74f521fd8bc03329e6f0e30f029d27548b7dca3044f97c8f3fa6242a8f5df583de90

      • memory/228-226-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-988-0x000000000A310000-0x000000000A322000-memory.dmp

        Filesize

        72KB

      • memory/228-1002-0x0000000002C90000-0x0000000002CD6000-memory.dmp

        Filesize

        280KB

      • memory/228-998-0x0000000004A30000-0x0000000004A80000-memory.dmp

        Filesize

        320KB

      • memory/228-997-0x000000000B840000-0x000000000B85E000-memory.dmp

        Filesize

        120KB

      • memory/228-996-0x000000000B290000-0x000000000B7BC000-memory.dmp

        Filesize

        5.2MB

      • memory/228-995-0x000000000B0C0000-0x000000000B282000-memory.dmp

        Filesize

        1.8MB

      • memory/228-994-0x000000000AFE0000-0x000000000B056000-memory.dmp

        Filesize

        472KB

      • memory/228-993-0x000000000AF20000-0x000000000AFB2000-memory.dmp

        Filesize

        584KB

      • memory/228-992-0x000000000A750000-0x000000000A7B6000-memory.dmp

        Filesize

        408KB

      • memory/228-991-0x0000000007390000-0x00000000073A0000-memory.dmp

        Filesize

        64KB

      • memory/228-990-0x000000000A450000-0x000000000A48C000-memory.dmp

        Filesize

        240KB

      • memory/228-989-0x000000000A330000-0x000000000A43A000-memory.dmp

        Filesize

        1.0MB

      • memory/228-987-0x0000000009CD0000-0x000000000A2E8000-memory.dmp

        Filesize

        6.1MB

      • memory/228-228-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-224-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-222-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-220-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-218-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-216-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-210-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-214-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-213-0x0000000007390000-0x00000000073A0000-memory.dmp

        Filesize

        64KB

      • memory/228-191-0x0000000002C90000-0x0000000002CD6000-memory.dmp

        Filesize

        280KB

      • memory/228-193-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-192-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-195-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-197-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-199-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-201-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-203-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-205-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-207-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/228-209-0x0000000007390000-0x00000000073A0000-memory.dmp

        Filesize

        64KB

      • memory/228-211-0x0000000007390000-0x00000000073A0000-memory.dmp

        Filesize

        64KB

      • memory/1232-174-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-148-0x0000000002C70000-0x0000000002C9D000-memory.dmp

        Filesize

        180KB

      • memory/1232-186-0x0000000000400000-0x0000000002B9E000-memory.dmp

        Filesize

        39.6MB

      • memory/1232-184-0x0000000003060000-0x0000000003070000-memory.dmp

        Filesize

        64KB

      • memory/1232-183-0x0000000003060000-0x0000000003070000-memory.dmp

        Filesize

        64KB

      • memory/1232-182-0x0000000003060000-0x0000000003070000-memory.dmp

        Filesize

        64KB

      • memory/1232-181-0x0000000000400000-0x0000000002B9E000-memory.dmp

        Filesize

        39.6MB

      • memory/1232-180-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-150-0x0000000003060000-0x0000000003070000-memory.dmp

        Filesize

        64KB

      • memory/1232-178-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-176-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-170-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-152-0x0000000003060000-0x0000000003070000-memory.dmp

        Filesize

        64KB

      • memory/1232-151-0x0000000003060000-0x0000000003070000-memory.dmp

        Filesize

        64KB

      • memory/1232-153-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-168-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-166-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-164-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-162-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-160-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-158-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-156-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-154-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1232-149-0x0000000007210000-0x00000000077B4000-memory.dmp

        Filesize

        5.6MB

      • memory/1232-172-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

        Filesize

        72KB

      • memory/1420-1006-0x00000000004E0000-0x0000000000508000-memory.dmp

        Filesize

        160KB

      • memory/1420-1007-0x0000000007200000-0x0000000007210000-memory.dmp

        Filesize

        64KB