Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/04/2023, 17:47

General

  • Target

    e3cc900664418e839d1c2c7684f75aa8e50afa3b367b8b2b0c3bf7b2d115baf8.exe

  • Size

    695KB

  • MD5

    5455061b8e9507ceb125e715919062fd

  • SHA1

    d988671f80062006b1d1c61701a13d6ef069eeba

  • SHA256

    e3cc900664418e839d1c2c7684f75aa8e50afa3b367b8b2b0c3bf7b2d115baf8

  • SHA512

    a51a7a6a86a90b9e36362514f005f9e9f1c80c26fa6a1841c3f3b41c25475ffa8a7753836ed44d2440fecb29952260cb227b6e090de2f6749f424d9277ee9a5e

  • SSDEEP

    12288:xy903KNwvnOc9E9mCDPAwi46P9W8g89ppreUPcdC54dV45VNU73/CHxyr:xyT2OKE9LDG4CEo/GD/0NU7322

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3cc900664418e839d1c2c7684f75aa8e50afa3b367b8b2b0c3bf7b2d115baf8.exe
    "C:\Users\Admin\AppData\Local\Temp\e3cc900664418e839d1c2c7684f75aa8e50afa3b367b8b2b0c3bf7b2d115baf8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un471209.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un471209.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\10322686.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\10322686.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3208
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 1080
          4⤵
          • Program crash
          PID:3404
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk391955.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk391955.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:860
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 1192
          4⤵
          • Program crash
          PID:1904
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si060864.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si060864.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3868
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3208 -ip 3208
    1⤵
      PID:4136
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 860 -ip 860
      1⤵
        PID:952

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si060864.exe

        Filesize

        136KB

        MD5

        73cae2858379cab7e68b9e5bf751c372

        SHA1

        38c375354bda6e5c8fb2579f1ef0416a6c65929a

        SHA256

        e423b9b79b441e48fd15c0980c78bf87ddaab308fa1c5d5ecdfbd85e1da73f1c

        SHA512

        343c2e4470d42c5078a7e4025509779bfd4b92b5c8b71a9e270acb2b98b6b6fcfa04f8158d9c10c468d0984daac5c8f316424df5e4def7db13e8768eb0d7c7d8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si060864.exe

        Filesize

        136KB

        MD5

        73cae2858379cab7e68b9e5bf751c372

        SHA1

        38c375354bda6e5c8fb2579f1ef0416a6c65929a

        SHA256

        e423b9b79b441e48fd15c0980c78bf87ddaab308fa1c5d5ecdfbd85e1da73f1c

        SHA512

        343c2e4470d42c5078a7e4025509779bfd4b92b5c8b71a9e270acb2b98b6b6fcfa04f8158d9c10c468d0984daac5c8f316424df5e4def7db13e8768eb0d7c7d8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un471209.exe

        Filesize

        541KB

        MD5

        788cc3426dac7f71c21af4a4db04c3c4

        SHA1

        95b9844709a4640fc989784c01987dc4219f4d51

        SHA256

        84a02d71a8c87d635516f0f98d1ea4ccd0b59165d36dd5b12128451fa97e3c05

        SHA512

        eafd9ca8c2b8a93dcc94d2987b5b60e9d35dc889b5ba24b70485bb1089d933be77c2353069f77b318b6cdc05523bac8c34b8cf47324e7b8047d010f1f6f410aa

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un471209.exe

        Filesize

        541KB

        MD5

        788cc3426dac7f71c21af4a4db04c3c4

        SHA1

        95b9844709a4640fc989784c01987dc4219f4d51

        SHA256

        84a02d71a8c87d635516f0f98d1ea4ccd0b59165d36dd5b12128451fa97e3c05

        SHA512

        eafd9ca8c2b8a93dcc94d2987b5b60e9d35dc889b5ba24b70485bb1089d933be77c2353069f77b318b6cdc05523bac8c34b8cf47324e7b8047d010f1f6f410aa

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\10322686.exe

        Filesize

        258KB

        MD5

        bae76b87d73469eed9f4b5d4977e9713

        SHA1

        20ef504016fd05098a14138501f0b5bf1945c53c

        SHA256

        8e72d76dc575b6ed772b34a00876ffc29d4d53daddb118c8b34c3e07d275bf21

        SHA512

        d51002edefc6ae60a6cb7367b5d1b2353564547d61d27956369cb47c71a21f4cfe5825abc4ea246e40f8d75ee854e0b952c26ff7987474e22349ddfb6b6b24de

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\10322686.exe

        Filesize

        258KB

        MD5

        bae76b87d73469eed9f4b5d4977e9713

        SHA1

        20ef504016fd05098a14138501f0b5bf1945c53c

        SHA256

        8e72d76dc575b6ed772b34a00876ffc29d4d53daddb118c8b34c3e07d275bf21

        SHA512

        d51002edefc6ae60a6cb7367b5d1b2353564547d61d27956369cb47c71a21f4cfe5825abc4ea246e40f8d75ee854e0b952c26ff7987474e22349ddfb6b6b24de

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk391955.exe

        Filesize

        341KB

        MD5

        6bdfa0add99b8ff5b2e6b85001272a45

        SHA1

        1d648a38e022711fc070ae556135a5ac594bf7b5

        SHA256

        d8bface69271995a468246afdb238d031ad25dba3995f5f0ccea87ab3ac8528f

        SHA512

        5659620b9aca37bfaa6e46483edf65fc68a188acbf3b820a10cdaa6b4ad14adf1dafd34c883cd596ddc83ce2a4bd2e0aa65102e2f16ce1e652e4933d2e43484d

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk391955.exe

        Filesize

        341KB

        MD5

        6bdfa0add99b8ff5b2e6b85001272a45

        SHA1

        1d648a38e022711fc070ae556135a5ac594bf7b5

        SHA256

        d8bface69271995a468246afdb238d031ad25dba3995f5f0ccea87ab3ac8528f

        SHA512

        5659620b9aca37bfaa6e46483edf65fc68a188acbf3b820a10cdaa6b4ad14adf1dafd34c883cd596ddc83ce2a4bd2e0aa65102e2f16ce1e652e4933d2e43484d

      • memory/860-366-0x00000000071E0000-0x00000000071F0000-memory.dmp

        Filesize

        64KB

      • memory/860-985-0x000000000A300000-0x000000000A312000-memory.dmp

        Filesize

        72KB

      • memory/860-996-0x0000000004C00000-0x0000000004C50000-memory.dmp

        Filesize

        320KB

      • memory/860-994-0x000000000B4B0000-0x000000000B9DC000-memory.dmp

        Filesize

        5.2MB

      • memory/860-993-0x000000000B2E0000-0x000000000B4A2000-memory.dmp

        Filesize

        1.8MB

      • memory/860-992-0x000000000B1B0000-0x000000000B1CE000-memory.dmp

        Filesize

        120KB

      • memory/860-991-0x000000000B100000-0x000000000B176000-memory.dmp

        Filesize

        472KB

      • memory/860-990-0x000000000AF50000-0x000000000AFE2000-memory.dmp

        Filesize

        584KB

      • memory/860-989-0x000000000A740000-0x000000000A7A6000-memory.dmp

        Filesize

        408KB

      • memory/860-987-0x00000000071E0000-0x00000000071F0000-memory.dmp

        Filesize

        64KB

      • memory/860-988-0x000000000A440000-0x000000000A47C000-memory.dmp

        Filesize

        240KB

      • memory/860-986-0x000000000A320000-0x000000000A42A000-memory.dmp

        Filesize

        1.0MB

      • memory/860-984-0x0000000009C60000-0x000000000A278000-memory.dmp

        Filesize

        6.1MB

      • memory/860-368-0x00000000071E0000-0x00000000071F0000-memory.dmp

        Filesize

        64KB

      • memory/860-364-0x00000000071E0000-0x00000000071F0000-memory.dmp

        Filesize

        64KB

      • memory/860-362-0x0000000002CE0000-0x0000000002D26000-memory.dmp

        Filesize

        280KB

      • memory/860-221-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-219-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-217-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-215-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-188-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-189-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-191-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-193-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-195-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-197-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-199-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-201-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-203-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-205-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-207-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-209-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-211-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/860-213-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/3208-168-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-149-0x0000000002BA0000-0x0000000002BCD000-memory.dmp

        Filesize

        180KB

      • memory/3208-183-0x0000000000400000-0x0000000002B9B000-memory.dmp

        Filesize

        39.6MB

      • memory/3208-181-0x0000000000400000-0x0000000002B9B000-memory.dmp

        Filesize

        39.6MB

      • memory/3208-180-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-178-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-170-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-176-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-174-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-151-0x0000000007260000-0x0000000007270000-memory.dmp

        Filesize

        64KB

      • memory/3208-152-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-172-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-160-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-166-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-164-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-162-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-153-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-158-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-156-0x0000000004870000-0x0000000004883000-memory.dmp

        Filesize

        76KB

      • memory/3208-154-0x0000000007260000-0x0000000007270000-memory.dmp

        Filesize

        64KB

      • memory/3208-150-0x0000000007260000-0x0000000007270000-memory.dmp

        Filesize

        64KB

      • memory/3208-148-0x0000000007270000-0x0000000007814000-memory.dmp

        Filesize

        5.6MB

      • memory/3868-1002-0x0000000000010000-0x0000000000038000-memory.dmp

        Filesize

        160KB

      • memory/3868-1003-0x0000000007170000-0x0000000007180000-memory.dmp

        Filesize

        64KB