Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2023, 18:45 UTC

General

  • Target

    927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe

  • Size

    308KB

  • MD5

    56e23384e1002c6cee17fd94fc45dd15

  • SHA1

    c4c74b902c8d959490bdb3c838d58c4103fdf208

  • SHA256

    927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199

  • SHA512

    80323ef87f7aaaea01e5e25edcfc3b9bd5231a4ebbf3b1c066cedab0aaa281db6138812827ceb8a8f85e06b3107500dcf907a21fb40134424cdf6978c46231c1

  • SSDEEP

    6144:Kgy+bnr+Bp0yN90QERlEY+zbPsE4JqR7wVvEXQwjxyoEifap:QMrFy90vb+zzet+ytifap

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe
    "C:\Users\Admin\AppData\Local\Temp\927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7688351.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7688351.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2344
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h8448716.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h8448716.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3916

Network

  • flag-us
    DNS
    123.108.74.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    123.108.74.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    111.124.91.77.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    111.124.91.77.in-addr.arpa
    IN PTR
    Response
    111.124.91.77.in-addr.arpa
    IN PTR
    hosted-by yeezyhostnet
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    64.13.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.13.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.36.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.36.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
    Remote address:
    8.8.8.8:53
    Request
    d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
    IN PTR
    Response
  • 93.184.220.29:80
    322 B
    7
  • 77.91.124.111:19069
    h8448716.exe
    260 B
    5
  • 40.125.122.176:443
    260 B
    5
  • 77.91.124.111:19069
    h8448716.exe
    10.4kB
    7.8kB
    21
    14
  • 104.208.16.90:443
    322 B
    7
  • 209.197.3.8:80
    322 B
    7
  • 173.223.113.164:443
    322 B
    7
  • 173.223.113.131:80
    322 B
    7
  • 204.79.197.203:80
    322 B
    7
  • 40.125.122.151:443
    260 B
    5
  • 8.248.1.254:80
    322 B
    7
  • 8.8.8.8:53
    123.108.74.40.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    123.108.74.40.in-addr.arpa

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    111.124.91.77.in-addr.arpa
    dns
    72 B
    109 B
    1
    1

    DNS Request

    111.124.91.77.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    64.13.109.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    64.13.109.52.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    2.36.159.162.in-addr.arpa
    dns
    71 B
    133 B
    1
    1

    DNS Request

    2.36.159.162.in-addr.arpa

  • 8.8.8.8:53
    d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
    dns
    118 B
    204 B
    1
    1

    DNS Request

    d.3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.8.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7688351.exe

    Filesize

    176KB

    MD5

    d00ae4bad5322688b1fd5052d9bb8140

    SHA1

    aafcfbf9a2451dab2a7a96ed7dbb4608dd89a136

    SHA256

    0de64fcd2968bb194cc03016d03d26040d7cad443c85495915f474cecc5aa9cc

    SHA512

    16f51d81e21f160c87031337830aa43ab3be4926bcf88c459fc22c29e10d00fad3789ce9c2a8380b135f14bf844e6b799d6d28ca854da4ec0df63caeaa25202c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7688351.exe

    Filesize

    176KB

    MD5

    d00ae4bad5322688b1fd5052d9bb8140

    SHA1

    aafcfbf9a2451dab2a7a96ed7dbb4608dd89a136

    SHA256

    0de64fcd2968bb194cc03016d03d26040d7cad443c85495915f474cecc5aa9cc

    SHA512

    16f51d81e21f160c87031337830aa43ab3be4926bcf88c459fc22c29e10d00fad3789ce9c2a8380b135f14bf844e6b799d6d28ca854da4ec0df63caeaa25202c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h8448716.exe

    Filesize

    136KB

    MD5

    287e9e7b78d53769d293790f6c33c5a3

    SHA1

    9f299b8b58062347a5fba2cff44088ad8f6ea194

    SHA256

    223bb6f3aa7d07fc251ff4b7c7e5f4226babe69a765ddef0d8059cc8ec741441

    SHA512

    df2645cce2720c3b25c6381be39d344c187d96e3ea7ddc283408f511897e70ac8923a01c43bef441dcfaa1c618408a0f51c2a4643b058297a4801b3eafccc99a

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h8448716.exe

    Filesize

    136KB

    MD5

    287e9e7b78d53769d293790f6c33c5a3

    SHA1

    9f299b8b58062347a5fba2cff44088ad8f6ea194

    SHA256

    223bb6f3aa7d07fc251ff4b7c7e5f4226babe69a765ddef0d8059cc8ec741441

    SHA512

    df2645cce2720c3b25c6381be39d344c187d96e3ea7ddc283408f511897e70ac8923a01c43bef441dcfaa1c618408a0f51c2a4643b058297a4801b3eafccc99a

  • memory/2344-171-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-143-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/2344-144-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-145-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-147-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-149-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-151-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-153-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-157-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-155-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-159-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-161-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-163-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-165-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-167-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-169-0x0000000002500000-0x0000000002512000-memory.dmp

    Filesize

    72KB

  • memory/2344-172-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/2344-141-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/2344-173-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/2344-174-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/2344-142-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/2344-140-0x0000000004B10000-0x00000000050B4000-memory.dmp

    Filesize

    5.6MB

  • memory/3916-188-0x00000000086D0000-0x0000000008746000-memory.dmp

    Filesize

    472KB

  • memory/3916-191-0x0000000008A20000-0x0000000008A3E000-memory.dmp

    Filesize

    120KB

  • memory/3916-181-0x0000000007730000-0x0000000007742000-memory.dmp

    Filesize

    72KB

  • memory/3916-182-0x0000000007860000-0x000000000796A000-memory.dmp

    Filesize

    1.0MB

  • memory/3916-183-0x0000000007790000-0x00000000077CC000-memory.dmp

    Filesize

    240KB

  • memory/3916-179-0x0000000000A20000-0x0000000000A48000-memory.dmp

    Filesize

    160KB

  • memory/3916-187-0x0000000008770000-0x0000000008802000-memory.dmp

    Filesize

    584KB

  • memory/3916-186-0x00000000079E0000-0x0000000007A46000-memory.dmp

    Filesize

    408KB

  • memory/3916-180-0x0000000007CB0000-0x00000000082C8000-memory.dmp

    Filesize

    6.1MB

  • memory/3916-185-0x0000000007AD0000-0x0000000007AE0000-memory.dmp

    Filesize

    64KB

  • memory/3916-189-0x0000000008BD0000-0x0000000008D92000-memory.dmp

    Filesize

    1.8MB

  • memory/3916-190-0x00000000098A0000-0x0000000009DCC000-memory.dmp

    Filesize

    5.2MB

  • memory/3916-184-0x0000000007AD0000-0x0000000007AE0000-memory.dmp

    Filesize

    64KB

  • memory/3916-192-0x0000000002BB0000-0x0000000002C00000-memory.dmp

    Filesize

    320KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.