Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    71s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26/04/2023, 18:13

General

  • Target

    94ec63d53685ff39acbf43143cc01f43b987e4eb47f8febcd26d2f2fd5f300d4.exe

  • Size

    691KB

  • MD5

    2939af54ec7ac240a0e1ecc621ad8e43

  • SHA1

    a4cc3713140198dbfb6b52df85dea79f94e2998c

  • SHA256

    94ec63d53685ff39acbf43143cc01f43b987e4eb47f8febcd26d2f2fd5f300d4

  • SHA512

    eaa4d3377320205811466d4c5fab57300f5d2413b785fdf29fde29bfcb891626f4b0e5e153e10d1ca6bec37711c696b4c30edacdc6b9e2edf414932ca3d3240d

  • SSDEEP

    12288:1y90cDclXnR7Qwgx4A0LJuqLuZB/Sve2M7CGKANBfbzV/6u/m4kO:1yzKXnOw64NuqLAE22fANZbz3b

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94ec63d53685ff39acbf43143cc01f43b987e4eb47f8febcd26d2f2fd5f300d4.exe
    "C:\Users\Admin\AppData\Local\Temp\94ec63d53685ff39acbf43143cc01f43b987e4eb47f8febcd26d2f2fd5f300d4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un494736.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un494736.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\66425100.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\66425100.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3940
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878726.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878726.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878726.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878726.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:60
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si568370.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si568370.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3888

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si568370.exe

    Filesize

    136KB

    MD5

    e1c805d3cefe221689da30b8a2d944f2

    SHA1

    a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

    SHA256

    32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

    SHA512

    7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si568370.exe

    Filesize

    136KB

    MD5

    e1c805d3cefe221689da30b8a2d944f2

    SHA1

    a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

    SHA256

    32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

    SHA512

    7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un494736.exe

    Filesize

    537KB

    MD5

    4fb11bf5300f62d0e77fc85541b54d50

    SHA1

    62885f8ec5bd74d3edbc608cde64225933ca82fa

    SHA256

    47e05cc0cb192afd85fa4ea11786edda55a4923ccda06b658b7da2abd96ac8ad

    SHA512

    d040afffc23b2a08e749a87250e63a2f3a58a4edb4aa787b4653654d86429d20532c00985c7dd53e78492b9e4b6e1b3783e59097c7f5b676cacbe906769e2595

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un494736.exe

    Filesize

    537KB

    MD5

    4fb11bf5300f62d0e77fc85541b54d50

    SHA1

    62885f8ec5bd74d3edbc608cde64225933ca82fa

    SHA256

    47e05cc0cb192afd85fa4ea11786edda55a4923ccda06b658b7da2abd96ac8ad

    SHA512

    d040afffc23b2a08e749a87250e63a2f3a58a4edb4aa787b4653654d86429d20532c00985c7dd53e78492b9e4b6e1b3783e59097c7f5b676cacbe906769e2595

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\66425100.exe

    Filesize

    259KB

    MD5

    677c0da804037e1736c47c1fb7654ca4

    SHA1

    44fb874ab5a8f0b7df72e91395374a323bc0d12a

    SHA256

    d3c70f503c5238a3d103fbb496af4e803bba8877bde4976f9be2889d3fd15312

    SHA512

    96cee7f9f2775d1f3d38dc3620db2f859574f24fbb6d1799b74ddfc07c4d9988ffcc0e8f5c8fc9553113c80232156dc2cab643aab80036df0973a690ef92149e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\66425100.exe

    Filesize

    259KB

    MD5

    677c0da804037e1736c47c1fb7654ca4

    SHA1

    44fb874ab5a8f0b7df72e91395374a323bc0d12a

    SHA256

    d3c70f503c5238a3d103fbb496af4e803bba8877bde4976f9be2889d3fd15312

    SHA512

    96cee7f9f2775d1f3d38dc3620db2f859574f24fbb6d1799b74ddfc07c4d9988ffcc0e8f5c8fc9553113c80232156dc2cab643aab80036df0973a690ef92149e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878726.exe

    Filesize

    342KB

    MD5

    94a3c0dcdf8071a0f0f6d7c56c8549d2

    SHA1

    5a2d0a547a28886a79fb744ddd0f1198872be170

    SHA256

    dbaf987c89f5e8c3e5e30502264c2b27d50d9829152fa39294a69eecb1722cb3

    SHA512

    cc990307f9a1c6cf495e607727bde45400d48f5f6e26cc218e9933be7bf709515394e84972172ab47a3b7de8887ec21c6371ded079e233b38d89cb542ba951f4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878726.exe

    Filesize

    342KB

    MD5

    94a3c0dcdf8071a0f0f6d7c56c8549d2

    SHA1

    5a2d0a547a28886a79fb744ddd0f1198872be170

    SHA256

    dbaf987c89f5e8c3e5e30502264c2b27d50d9829152fa39294a69eecb1722cb3

    SHA512

    cc990307f9a1c6cf495e607727bde45400d48f5f6e26cc218e9933be7bf709515394e84972172ab47a3b7de8887ec21c6371ded079e233b38d89cb542ba951f4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk878726.exe

    Filesize

    342KB

    MD5

    94a3c0dcdf8071a0f0f6d7c56c8549d2

    SHA1

    5a2d0a547a28886a79fb744ddd0f1198872be170

    SHA256

    dbaf987c89f5e8c3e5e30502264c2b27d50d9829152fa39294a69eecb1722cb3

    SHA512

    cc990307f9a1c6cf495e607727bde45400d48f5f6e26cc218e9933be7bf709515394e84972172ab47a3b7de8887ec21c6371ded079e233b38d89cb542ba951f4

  • memory/60-211-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-204-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-1002-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/60-996-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/60-226-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-223-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-221-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-219-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-217-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-215-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-213-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-208-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-206-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-185-0x0000000002390000-0x00000000023CC000-memory.dmp

    Filesize

    240KB

  • memory/60-202-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-200-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-197-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-195-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/60-193-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/60-191-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-189-0x0000000002560000-0x0000000002595000-memory.dmp

    Filesize

    212KB

  • memory/60-190-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/60-188-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/60-176-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/60-187-0x0000000002560000-0x000000000259A000-memory.dmp

    Filesize

    232KB

  • memory/60-179-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/60-180-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/1004-178-0x0000000000580000-0x00000000005C7000-memory.dmp

    Filesize

    284KB

  • memory/3888-209-0x0000000007170000-0x00000000071AE000-memory.dmp

    Filesize

    248KB

  • memory/3888-199-0x0000000007240000-0x000000000734A000-memory.dmp

    Filesize

    1.0MB

  • memory/3888-997-0x0000000008310000-0x0000000008360000-memory.dmp

    Filesize

    320KB

  • memory/3888-428-0x00000000082E0000-0x00000000082FE000-memory.dmp

    Filesize

    120KB

  • memory/3888-412-0x0000000009110000-0x000000000963C000-memory.dmp

    Filesize

    5.2MB

  • memory/3888-405-0x0000000008A10000-0x0000000008BD2000-memory.dmp

    Filesize

    1.8MB

  • memory/3888-394-0x00000000081E0000-0x0000000008256000-memory.dmp

    Filesize

    472KB

  • memory/3888-192-0x00000000076C0000-0x0000000007CC6000-memory.dmp

    Filesize

    6.0MB

  • memory/3888-379-0x0000000007F70000-0x0000000008002000-memory.dmp

    Filesize

    584KB

  • memory/3888-305-0x00000000074F0000-0x0000000007556000-memory.dmp

    Filesize

    408KB

  • memory/3888-186-0x0000000000430000-0x0000000000458000-memory.dmp

    Filesize

    160KB

  • memory/3888-231-0x0000000007470000-0x0000000007480000-memory.dmp

    Filesize

    64KB

  • memory/3888-224-0x00000000071B0000-0x00000000071FB000-memory.dmp

    Filesize

    300KB

  • memory/3888-196-0x0000000007110000-0x0000000007122000-memory.dmp

    Filesize

    72KB

  • memory/3940-169-0x0000000004C20000-0x0000000004C30000-memory.dmp

    Filesize

    64KB

  • memory/3940-148-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-162-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-158-0x0000000004C20000-0x0000000004C30000-memory.dmp

    Filesize

    64KB

  • memory/3940-160-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-152-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-140-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-132-0x00000000007D0000-0x00000000007EA000-memory.dmp

    Filesize

    104KB

  • memory/3940-155-0x0000000004C20000-0x0000000004C30000-memory.dmp

    Filesize

    64KB

  • memory/3940-157-0x0000000004C20000-0x0000000004C30000-memory.dmp

    Filesize

    64KB

  • memory/3940-156-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-153-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/3940-150-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-164-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-166-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-146-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-167-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/3940-170-0x0000000000400000-0x0000000000455000-memory.dmp

    Filesize

    340KB

  • memory/3940-171-0x0000000004C20000-0x0000000004C30000-memory.dmp

    Filesize

    64KB

  • memory/3940-138-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-136-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-135-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-133-0x0000000004C30000-0x000000000512E000-memory.dmp

    Filesize

    5.0MB

  • memory/3940-144-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB

  • memory/3940-134-0x0000000002200000-0x0000000002218000-memory.dmp

    Filesize

    96KB

  • memory/3940-142-0x0000000002200000-0x0000000002213000-memory.dmp

    Filesize

    76KB