Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    66s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/04/2023, 20:18

General

  • Target

    56892286e12a3c3ae33d88c75db71c482970d0391e23ce2091bb93a1916c6e73.exe

  • Size

    695KB

  • MD5

    84b498c7f647c0ee360892ad959f4d49

  • SHA1

    c316ab6829d918f4d241815ba8fe8a18320a129c

  • SHA256

    56892286e12a3c3ae33d88c75db71c482970d0391e23ce2091bb93a1916c6e73

  • SHA512

    be62a91c88e618def55a16246066a84a57b4e057e4c3f72d5e5544c4f7fcb5c86f18170796df61c9d1ddea932e62e6570637163fa16288fb1f4254bb7d84af54

  • SSDEEP

    12288:by90cn2Tq6iFZVfw2kpD1q4MBPT/iPTW0kXzwQTy3ZULH17CdC:byHMqTFffwFwBraPThkjwQ9Nv

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56892286e12a3c3ae33d88c75db71c482970d0391e23ce2091bb93a1916c6e73.exe
    "C:\Users\Admin\AppData\Local\Temp\56892286e12a3c3ae33d88c75db71c482970d0391e23ce2091bb93a1916c6e73.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un003556.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un003556.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01940173.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01940173.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3204
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 1064
          4⤵
          • Program crash
          PID:1236
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk540032.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk540032.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1904
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 1440
          4⤵
          • Program crash
          PID:2192
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si446626.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si446626.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4828
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3204 -ip 3204
    1⤵
      PID:3896
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1904 -ip 1904
      1⤵
        PID:4880

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si446626.exe

        Filesize

        136KB

        MD5

        73cae2858379cab7e68b9e5bf751c372

        SHA1

        38c375354bda6e5c8fb2579f1ef0416a6c65929a

        SHA256

        e423b9b79b441e48fd15c0980c78bf87ddaab308fa1c5d5ecdfbd85e1da73f1c

        SHA512

        343c2e4470d42c5078a7e4025509779bfd4b92b5c8b71a9e270acb2b98b6b6fcfa04f8158d9c10c468d0984daac5c8f316424df5e4def7db13e8768eb0d7c7d8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si446626.exe

        Filesize

        136KB

        MD5

        73cae2858379cab7e68b9e5bf751c372

        SHA1

        38c375354bda6e5c8fb2579f1ef0416a6c65929a

        SHA256

        e423b9b79b441e48fd15c0980c78bf87ddaab308fa1c5d5ecdfbd85e1da73f1c

        SHA512

        343c2e4470d42c5078a7e4025509779bfd4b92b5c8b71a9e270acb2b98b6b6fcfa04f8158d9c10c468d0984daac5c8f316424df5e4def7db13e8768eb0d7c7d8

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un003556.exe

        Filesize

        541KB

        MD5

        84df962634f8d1f18e8f15dfc9edc8ef

        SHA1

        3a95e69dc5d8dd89379a0ccf28c1995840d352d1

        SHA256

        05e9e1b837f103f51a8a363250660f79ad400f87aa8e8082563b6bafe9228f85

        SHA512

        e72e1101985b3deb20904a953db15c78c6ea842b44d3b262c0fc2fd8d257b97fb633c61deb6c0158da45b78bad7f79e9a5a650b237c00be74cbd647d2a4edb0d

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un003556.exe

        Filesize

        541KB

        MD5

        84df962634f8d1f18e8f15dfc9edc8ef

        SHA1

        3a95e69dc5d8dd89379a0ccf28c1995840d352d1

        SHA256

        05e9e1b837f103f51a8a363250660f79ad400f87aa8e8082563b6bafe9228f85

        SHA512

        e72e1101985b3deb20904a953db15c78c6ea842b44d3b262c0fc2fd8d257b97fb633c61deb6c0158da45b78bad7f79e9a5a650b237c00be74cbd647d2a4edb0d

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01940173.exe

        Filesize

        258KB

        MD5

        b14f30805aa1d3cde4c2c7fd767598ef

        SHA1

        c0a8774d472048a389a0475fcae5f69bbc2bc840

        SHA256

        8c173284f092cde27239f0920075ba0d58139834fae5a112c3ee19b8ea7bf869

        SHA512

        8675ba866d40a57a2faba0df56a181ddd33206bb16ffe48a37d9a8164761c8217f0b737be55df7a700362c56edcd123c4d00323d88901e43cbb26ab47366610b

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01940173.exe

        Filesize

        258KB

        MD5

        b14f30805aa1d3cde4c2c7fd767598ef

        SHA1

        c0a8774d472048a389a0475fcae5f69bbc2bc840

        SHA256

        8c173284f092cde27239f0920075ba0d58139834fae5a112c3ee19b8ea7bf869

        SHA512

        8675ba866d40a57a2faba0df56a181ddd33206bb16ffe48a37d9a8164761c8217f0b737be55df7a700362c56edcd123c4d00323d88901e43cbb26ab47366610b

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk540032.exe

        Filesize

        340KB

        MD5

        85d8fcad6f481a035e8060b0bf93e740

        SHA1

        c068f5c07cebb5a4d5b461471f7a8e81280ad424

        SHA256

        8f279203ff865b9064bd9ebc502f47cb48504556f04d45cc3770ca7d598ce672

        SHA512

        3bccd41a64054638614cadf6b9a08b2e2b171fc4b682249331434ed5af40349e4dab26b1d3fa3bf18aa399df46141396ad01369fc25cca859ab551d4a0ce6138

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk540032.exe

        Filesize

        340KB

        MD5

        85d8fcad6f481a035e8060b0bf93e740

        SHA1

        c068f5c07cebb5a4d5b461471f7a8e81280ad424

        SHA256

        8f279203ff865b9064bd9ebc502f47cb48504556f04d45cc3770ca7d598ce672

        SHA512

        3bccd41a64054638614cadf6b9a08b2e2b171fc4b682249331434ed5af40349e4dab26b1d3fa3bf18aa399df46141396ad01369fc25cca859ab551d4a0ce6138

      • memory/1904-985-0x0000000009D10000-0x000000000A328000-memory.dmp

        Filesize

        6.1MB

      • memory/1904-988-0x000000000A440000-0x000000000A47C000-memory.dmp

        Filesize

        240KB

      • memory/1904-1000-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/1904-999-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/1904-997-0x0000000004A90000-0x0000000004AE0000-memory.dmp

        Filesize

        320KB

      • memory/1904-996-0x000000000B520000-0x000000000BA4C000-memory.dmp

        Filesize

        5.2MB

      • memory/1904-995-0x000000000B340000-0x000000000B502000-memory.dmp

        Filesize

        1.8MB

      • memory/1904-994-0x000000000B080000-0x000000000B09E000-memory.dmp

        Filesize

        120KB

      • memory/1904-993-0x000000000AFC0000-0x000000000B036000-memory.dmp

        Filesize

        472KB

      • memory/1904-991-0x000000000AE10000-0x000000000AEA2000-memory.dmp

        Filesize

        584KB

      • memory/1904-990-0x000000000A740000-0x000000000A7A6000-memory.dmp

        Filesize

        408KB

      • memory/1904-989-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/1904-987-0x000000000A330000-0x000000000A43A000-memory.dmp

        Filesize

        1.0MB

      • memory/1904-986-0x00000000072A0000-0x00000000072B2000-memory.dmp

        Filesize

        72KB

      • memory/1904-383-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/1904-380-0x00000000072D0000-0x00000000072E0000-memory.dmp

        Filesize

        64KB

      • memory/1904-379-0x0000000002DF0000-0x0000000002E36000-memory.dmp

        Filesize

        280KB

      • memory/1904-223-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-221-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-217-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-219-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-215-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-190-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-191-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-193-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-195-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-197-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-199-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-201-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-203-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-205-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-207-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-209-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-211-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/1904-213-0x0000000007150000-0x0000000007185000-memory.dmp

        Filesize

        212KB

      • memory/3204-173-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-149-0x0000000007110000-0x00000000076B4000-memory.dmp

        Filesize

        5.6MB

      • memory/3204-185-0x0000000000400000-0x0000000002B9B000-memory.dmp

        Filesize

        39.6MB

      • memory/3204-183-0x0000000004830000-0x0000000004840000-memory.dmp

        Filesize

        64KB

      • memory/3204-182-0x0000000004830000-0x0000000004840000-memory.dmp

        Filesize

        64KB

      • memory/3204-181-0x0000000004830000-0x0000000004840000-memory.dmp

        Filesize

        64KB

      • memory/3204-180-0x0000000000400000-0x0000000002B9B000-memory.dmp

        Filesize

        39.6MB

      • memory/3204-179-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-151-0x0000000004830000-0x0000000004840000-memory.dmp

        Filesize

        64KB

      • memory/3204-177-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-175-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-153-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-152-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-150-0x0000000004830000-0x0000000004840000-memory.dmp

        Filesize

        64KB

      • memory/3204-161-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-167-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-165-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-163-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-169-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-159-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-157-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-155-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-171-0x00000000048E0000-0x00000000048F3000-memory.dmp

        Filesize

        76KB

      • memory/3204-148-0x0000000002BE0000-0x0000000002C0D000-memory.dmp

        Filesize

        180KB

      • memory/4828-1005-0x0000000000340000-0x0000000000368000-memory.dmp

        Filesize

        160KB

      • memory/4828-1006-0x00000000073E0000-0x00000000073F0000-memory.dmp

        Filesize

        64KB