Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2023, 18:45
Static task
static1
General
-
Target
927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe
-
Size
308KB
-
MD5
56e23384e1002c6cee17fd94fc45dd15
-
SHA1
c4c74b902c8d959490bdb3c838d58c4103fdf208
-
SHA256
927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199
-
SHA512
80323ef87f7aaaea01e5e25edcfc3b9bd5231a4ebbf3b1c066cedab0aaa281db6138812827ceb8a8f85e06b3107500dcf907a21fb40134424cdf6978c46231c1
-
SSDEEP
6144:Kgy+bnr+Bp0yN90QERlEY+zbPsE4JqR7wVvEXQwjxyoEifap:QMrFy90vb+zzet+ytifap
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" g7688351.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection g7688351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" g7688351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" g7688351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" g7688351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" g7688351.exe -
Executes dropped EXE 2 IoCs
pid Process 2344 g7688351.exe 3916 h8448716.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features g7688351.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" g7688351.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2344 g7688351.exe 2344 g7688351.exe 3916 h8448716.exe 3916 h8448716.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2344 g7688351.exe Token: SeDebugPrivilege 3916 h8448716.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1464 wrote to memory of 2344 1464 927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe 84 PID 1464 wrote to memory of 2344 1464 927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe 84 PID 1464 wrote to memory of 2344 1464 927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe 84 PID 1464 wrote to memory of 3916 1464 927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe 88 PID 1464 wrote to memory of 3916 1464 927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe 88 PID 1464 wrote to memory of 3916 1464 927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe"C:\Users\Admin\AppData\Local\Temp\927489cc9c682730fbb0b7ebc00f03806ca0f7d5de98629cabad69058e64a199.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7688351.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g7688351.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h8448716.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h8448716.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD5d00ae4bad5322688b1fd5052d9bb8140
SHA1aafcfbf9a2451dab2a7a96ed7dbb4608dd89a136
SHA2560de64fcd2968bb194cc03016d03d26040d7cad443c85495915f474cecc5aa9cc
SHA51216f51d81e21f160c87031337830aa43ab3be4926bcf88c459fc22c29e10d00fad3789ce9c2a8380b135f14bf844e6b799d6d28ca854da4ec0df63caeaa25202c
-
Filesize
176KB
MD5d00ae4bad5322688b1fd5052d9bb8140
SHA1aafcfbf9a2451dab2a7a96ed7dbb4608dd89a136
SHA2560de64fcd2968bb194cc03016d03d26040d7cad443c85495915f474cecc5aa9cc
SHA51216f51d81e21f160c87031337830aa43ab3be4926bcf88c459fc22c29e10d00fad3789ce9c2a8380b135f14bf844e6b799d6d28ca854da4ec0df63caeaa25202c
-
Filesize
136KB
MD5287e9e7b78d53769d293790f6c33c5a3
SHA19f299b8b58062347a5fba2cff44088ad8f6ea194
SHA256223bb6f3aa7d07fc251ff4b7c7e5f4226babe69a765ddef0d8059cc8ec741441
SHA512df2645cce2720c3b25c6381be39d344c187d96e3ea7ddc283408f511897e70ac8923a01c43bef441dcfaa1c618408a0f51c2a4643b058297a4801b3eafccc99a
-
Filesize
136KB
MD5287e9e7b78d53769d293790f6c33c5a3
SHA19f299b8b58062347a5fba2cff44088ad8f6ea194
SHA256223bb6f3aa7d07fc251ff4b7c7e5f4226babe69a765ddef0d8059cc8ec741441
SHA512df2645cce2720c3b25c6381be39d344c187d96e3ea7ddc283408f511897e70ac8923a01c43bef441dcfaa1c618408a0f51c2a4643b058297a4801b3eafccc99a