Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2023, 08:40

General

  • Target

    29c8cd2b396936d3726ccadc4d1e90e49c5a04247b4107abc5e42bdd995185bd.exe

  • Size

    697KB

  • MD5

    3f94c978968038d050a2e2efcd669659

  • SHA1

    eb7c383666de6635708dfc5cec3231e21f3ce570

  • SHA256

    29c8cd2b396936d3726ccadc4d1e90e49c5a04247b4107abc5e42bdd995185bd

  • SHA512

    f551d938a0a5969723d44a471e2cf4c5ed118600739850654ba8796cdf446a74ddbb2ae91846788d5f76af04535264126fc7b70ae05bfb55086a4432361f8261

  • SSDEEP

    12288:Ky90RW5Q4d6MdMbQRepoNgdqAuJwRIn5N0obBHAKkhHr8Ogj3kg5Rg3QQ:KysWT5epWAueTEBgKkhL8OgjN5Rm

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29c8cd2b396936d3726ccadc4d1e90e49c5a04247b4107abc5e42bdd995185bd.exe
    "C:\Users\Admin\AppData\Local\Temp\29c8cd2b396936d3726ccadc4d1e90e49c5a04247b4107abc5e42bdd995185bd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un298382.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un298382.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4452
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19675200.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19675200.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4648
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1100
          4⤵
          • Program crash
          PID:100
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk563974.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk563974.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4636
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 1496
          4⤵
          • Program crash
          PID:4192
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si913532.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si913532.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1832
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4648 -ip 4648
    1⤵
      PID:2800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4636 -ip 4636
      1⤵
        PID:4468

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si913532.exe

        Filesize

        136KB

        MD5

        bddaadcc91f12566dce088dfba102c2a

        SHA1

        6a141a09619ea3f5bbe2d946df9a8c427beb89f2

        SHA256

        536a77d74988fc47e1d6b53be4701d289ecf4e3598b02adcd936b4f29017a4f4

        SHA512

        f4b12e80f23ddbfd3c9fa79a009cb04e372f1ef6b48ea947b8c0fb14dfd3240c497be28023c78005b8dfd36a4080d98a9750606edf0a1fdfe57f53ef494e5c91

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si913532.exe

        Filesize

        136KB

        MD5

        bddaadcc91f12566dce088dfba102c2a

        SHA1

        6a141a09619ea3f5bbe2d946df9a8c427beb89f2

        SHA256

        536a77d74988fc47e1d6b53be4701d289ecf4e3598b02adcd936b4f29017a4f4

        SHA512

        f4b12e80f23ddbfd3c9fa79a009cb04e372f1ef6b48ea947b8c0fb14dfd3240c497be28023c78005b8dfd36a4080d98a9750606edf0a1fdfe57f53ef494e5c91

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un298382.exe

        Filesize

        543KB

        MD5

        9cd680686b75e8566ad511b379f05880

        SHA1

        30f2623fc46acb049e51b4f14cd3692505efcf00

        SHA256

        71ed15d4f3dcc2feb082c28f24e1c891020b75568626e3e03f2088066c1d7790

        SHA512

        1e6f94680886a5c4c8c3f756f11b89755732e36cbb504d21c122e7e71b23689ef93a5f2d6c98f1edea9ac2c9c9763805576d0d1bfe92b73c8df3323a41e579a4

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un298382.exe

        Filesize

        543KB

        MD5

        9cd680686b75e8566ad511b379f05880

        SHA1

        30f2623fc46acb049e51b4f14cd3692505efcf00

        SHA256

        71ed15d4f3dcc2feb082c28f24e1c891020b75568626e3e03f2088066c1d7790

        SHA512

        1e6f94680886a5c4c8c3f756f11b89755732e36cbb504d21c122e7e71b23689ef93a5f2d6c98f1edea9ac2c9c9763805576d0d1bfe92b73c8df3323a41e579a4

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19675200.exe

        Filesize

        265KB

        MD5

        c5f8cb4667d734edaaad95696e86fa39

        SHA1

        98bae27f66b618d8ede15cc1aeefa4b84b8a71e3

        SHA256

        78af1767005600a561bdd5bbfbdbaf8b5d62085f2c2be8ef67b4dfe926222a74

        SHA512

        b99fd7603e87723b1015768a5ba9c42778739d98dbb639cb0fbd163a1a51ac7ade64d61162a9b9e75c68d770824cecaaa031b28c164161bcbb6a3c32c1c88ee4

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19675200.exe

        Filesize

        265KB

        MD5

        c5f8cb4667d734edaaad95696e86fa39

        SHA1

        98bae27f66b618d8ede15cc1aeefa4b84b8a71e3

        SHA256

        78af1767005600a561bdd5bbfbdbaf8b5d62085f2c2be8ef67b4dfe926222a74

        SHA512

        b99fd7603e87723b1015768a5ba9c42778739d98dbb639cb0fbd163a1a51ac7ade64d61162a9b9e75c68d770824cecaaa031b28c164161bcbb6a3c32c1c88ee4

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk563974.exe

        Filesize

        347KB

        MD5

        0645ffd52c6da42b2a5284d6d6194d5a

        SHA1

        dfde38d1caa2f8f4bf0b4e894c62a1c667638228

        SHA256

        0f7b711a60c3aa6c8d63ff0f06b2f84b67459281158ffd1ea5c7c3c57e4d0044

        SHA512

        09a06f708c0b352ea2be4dbedd8e6f9dbbb55ed1bda6611300a99350e877265de9dc50a53507f53a667b8a44b1e473ebf790bee6b6b3c2fd40747ada83f90be3

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk563974.exe

        Filesize

        347KB

        MD5

        0645ffd52c6da42b2a5284d6d6194d5a

        SHA1

        dfde38d1caa2f8f4bf0b4e894c62a1c667638228

        SHA256

        0f7b711a60c3aa6c8d63ff0f06b2f84b67459281158ffd1ea5c7c3c57e4d0044

        SHA512

        09a06f708c0b352ea2be4dbedd8e6f9dbbb55ed1bda6611300a99350e877265de9dc50a53507f53a667b8a44b1e473ebf790bee6b6b3c2fd40747ada83f90be3

      • memory/1832-1007-0x00000000077C0000-0x00000000077D0000-memory.dmp

        Filesize

        64KB

      • memory/1832-1006-0x0000000000680000-0x00000000006A8000-memory.dmp

        Filesize

        160KB

      • memory/4636-225-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-229-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-999-0x0000000004C90000-0x0000000004CE0000-memory.dmp

        Filesize

        320KB

      • memory/4636-998-0x000000000B7D0000-0x000000000B7EE000-memory.dmp

        Filesize

        120KB

      • memory/4636-997-0x000000000B190000-0x000000000B6BC000-memory.dmp

        Filesize

        5.2MB

      • memory/4636-996-0x000000000AFC0000-0x000000000B182000-memory.dmp

        Filesize

        1.8MB

      • memory/4636-995-0x000000000AEE0000-0x000000000AF56000-memory.dmp

        Filesize

        472KB

      • memory/4636-994-0x000000000AE10000-0x000000000AEA2000-memory.dmp

        Filesize

        584KB

      • memory/4636-993-0x000000000A750000-0x000000000A7B6000-memory.dmp

        Filesize

        408KB

      • memory/4636-992-0x0000000007310000-0x0000000007320000-memory.dmp

        Filesize

        64KB

      • memory/4636-991-0x000000000A480000-0x000000000A4BC000-memory.dmp

        Filesize

        240KB

      • memory/4636-990-0x000000000A370000-0x000000000A47A000-memory.dmp

        Filesize

        1.0MB

      • memory/4636-989-0x00000000072B0000-0x00000000072C2000-memory.dmp

        Filesize

        72KB

      • memory/4636-988-0x0000000009D50000-0x000000000A368000-memory.dmp

        Filesize

        6.1MB

      • memory/4636-227-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-223-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-221-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-219-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-217-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-211-0x0000000007310000-0x0000000007320000-memory.dmp

        Filesize

        64KB

      • memory/4636-212-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-215-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-193-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-195-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-197-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-192-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-199-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-201-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-203-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-205-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-207-0x0000000002D20000-0x0000000002D66000-memory.dmp

        Filesize

        280KB

      • memory/4636-209-0x0000000007310000-0x0000000007320000-memory.dmp

        Filesize

        64KB

      • memory/4636-208-0x0000000004D10000-0x0000000004D45000-memory.dmp

        Filesize

        212KB

      • memory/4636-213-0x0000000007310000-0x0000000007320000-memory.dmp

        Filesize

        64KB

      • memory/4648-176-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-151-0x0000000007450000-0x0000000007460000-memory.dmp

        Filesize

        64KB

      • memory/4648-187-0x0000000000400000-0x0000000002B9D000-memory.dmp

        Filesize

        39.6MB

      • memory/4648-185-0x0000000007450000-0x0000000007460000-memory.dmp

        Filesize

        64KB

      • memory/4648-183-0x0000000007450000-0x0000000007460000-memory.dmp

        Filesize

        64KB

      • memory/4648-184-0x0000000007450000-0x0000000007460000-memory.dmp

        Filesize

        64KB

      • memory/4648-182-0x0000000002BE0000-0x0000000002C0D000-memory.dmp

        Filesize

        180KB

      • memory/4648-152-0x0000000007450000-0x0000000007460000-memory.dmp

        Filesize

        64KB

      • memory/4648-181-0x0000000000400000-0x0000000002B9D000-memory.dmp

        Filesize

        39.6MB

      • memory/4648-156-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-180-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-178-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-154-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-153-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-164-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-170-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-168-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-166-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-172-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-162-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-160-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-158-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-174-0x0000000004AE0000-0x0000000004AF3000-memory.dmp

        Filesize

        76KB

      • memory/4648-150-0x0000000007450000-0x0000000007460000-memory.dmp

        Filesize

        64KB

      • memory/4648-149-0x0000000007460000-0x0000000007A04000-memory.dmp

        Filesize

        5.6MB

      • memory/4648-148-0x0000000002BE0000-0x0000000002C0D000-memory.dmp

        Filesize

        180KB