Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 18:08

General

  • Target

    6810ce175b65d169fa6b9a45e595ddd451fa60157e6f4f194efb510763062a0a.exe

  • Size

    480KB

  • MD5

    ea2189a1c77af0ec95c34dba54071aed

  • SHA1

    3f67b82ab1d2380ae4803a3328c4abd4fe170691

  • SHA256

    6810ce175b65d169fa6b9a45e595ddd451fa60157e6f4f194efb510763062a0a

  • SHA512

    29f17d62d05cfa559197361095f8ce1d86bc4b09e7aef3c9e16245906a89105fc89277fa862de38d341a5a555a17e63936225e954e191833a675423bc9b114be

  • SSDEEP

    6144:Kqy+bnr+zp0yN90QETL+i/LqkisAp7B5/kch4gG/PiNbxbcpN7Hs+7VLwuhD/fga:+Mrry90BtssApL/kcVbxQMoLww4/i

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6810ce175b65d169fa6b9a45e595ddd451fa60157e6f4f194efb510763062a0a.exe
    "C:\Users\Admin\AppData\Local\Temp\6810ce175b65d169fa6b9a45e595ddd451fa60157e6f4f194efb510763062a0a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8579548.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8579548.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5056
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5833093.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5833093.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2360
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0014086.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0014086.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1216
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6064227.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6064227.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3684
      • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3728
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:560
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1732
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4940
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "oneetx.exe" /P "Admin:N"
              5⤵
                PID:4732
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                5⤵
                  PID:2088
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:2092
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\c3912af058" /P "Admin:N"
                    5⤵
                      PID:4452
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\c3912af058" /P "Admin:R" /E
                      5⤵
                        PID:444
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:3308
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:2584
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:3508

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6064227.exe

                Filesize

                206KB

                MD5

                2d19e1fc9c4e340fae4690452591dbef

                SHA1

                13408f66c25a3337ae7e6de437047267d887134b

                SHA256

                d2e105650b4a0f925bbcc2596dd5c2af964de2666914c8849ad28a2d38e05b1e

                SHA512

                9d02eac6934aed1dcdc3271d392dc02c70223482a5c1f27e2deb213b9aefa594aef4fa640f0c600331ce47a2a50e25fd7137b6e5ac76acc020f9b4f15cb6a36a

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d6064227.exe

                Filesize

                206KB

                MD5

                2d19e1fc9c4e340fae4690452591dbef

                SHA1

                13408f66c25a3337ae7e6de437047267d887134b

                SHA256

                d2e105650b4a0f925bbcc2596dd5c2af964de2666914c8849ad28a2d38e05b1e

                SHA512

                9d02eac6934aed1dcdc3271d392dc02c70223482a5c1f27e2deb213b9aefa594aef4fa640f0c600331ce47a2a50e25fd7137b6e5ac76acc020f9b4f15cb6a36a

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8579548.exe

                Filesize

                308KB

                MD5

                d97e104a238a4c8e8ef4be348deb9b0c

                SHA1

                7f4b0df51216dec0bcb491f54221c177f6285093

                SHA256

                579a1a378d320d4a3a7ca3cbfc484dd6a2b96787816b3393e39aced7af032deb

                SHA512

                d700123b023921477631483bb868136d18fc801340344c06046f66c0c810d960358d582184878c2f0f9c1904781a1098ddffad9c958e658a6dbc397d6f723102

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8579548.exe

                Filesize

                308KB

                MD5

                d97e104a238a4c8e8ef4be348deb9b0c

                SHA1

                7f4b0df51216dec0bcb491f54221c177f6285093

                SHA256

                579a1a378d320d4a3a7ca3cbfc484dd6a2b96787816b3393e39aced7af032deb

                SHA512

                d700123b023921477631483bb868136d18fc801340344c06046f66c0c810d960358d582184878c2f0f9c1904781a1098ddffad9c958e658a6dbc397d6f723102

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5833093.exe

                Filesize

                175KB

                MD5

                84b17549722d461d7f74f303eb15cd90

                SHA1

                bd9d461a857266ec90bdd7ac0d0a170743e5ab8c

                SHA256

                ef4ae8575ffe36799a8831baea716f9d506fd58752e17e5ca9ce962058a4a789

                SHA512

                0d7d4953c18169301981530acd97fa45cc0bffe07b7f03514d3f04e8e34217409fed777104b651632b2b5a4b3328a323936718a8d58364a7889532142eaba1c5

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a5833093.exe

                Filesize

                175KB

                MD5

                84b17549722d461d7f74f303eb15cd90

                SHA1

                bd9d461a857266ec90bdd7ac0d0a170743e5ab8c

                SHA256

                ef4ae8575ffe36799a8831baea716f9d506fd58752e17e5ca9ce962058a4a789

                SHA512

                0d7d4953c18169301981530acd97fa45cc0bffe07b7f03514d3f04e8e34217409fed777104b651632b2b5a4b3328a323936718a8d58364a7889532142eaba1c5

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0014086.exe

                Filesize

                136KB

                MD5

                d761b483361ead4b2b279af34ac67e41

                SHA1

                47771b1ef02fd4c159ba3b2cd744d99739dee5f6

                SHA256

                94e5eada65839a3dcc6ef8b3fed3177351c707e5ffc531c44766655cdd538e77

                SHA512

                fe151b7efc349a8e63a31a2041b7c4a48bb44fd334931d790abd66cc955c72c1909d8aec7d861849c963f09898a4befffbca3d3626d67ed90a424cb4cd160127

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0014086.exe

                Filesize

                136KB

                MD5

                d761b483361ead4b2b279af34ac67e41

                SHA1

                47771b1ef02fd4c159ba3b2cd744d99739dee5f6

                SHA256

                94e5eada65839a3dcc6ef8b3fed3177351c707e5ffc531c44766655cdd538e77

                SHA512

                fe151b7efc349a8e63a31a2041b7c4a48bb44fd334931d790abd66cc955c72c1909d8aec7d861849c963f09898a4befffbca3d3626d67ed90a424cb4cd160127

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                206KB

                MD5

                2d19e1fc9c4e340fae4690452591dbef

                SHA1

                13408f66c25a3337ae7e6de437047267d887134b

                SHA256

                d2e105650b4a0f925bbcc2596dd5c2af964de2666914c8849ad28a2d38e05b1e

                SHA512

                9d02eac6934aed1dcdc3271d392dc02c70223482a5c1f27e2deb213b9aefa594aef4fa640f0c600331ce47a2a50e25fd7137b6e5ac76acc020f9b4f15cb6a36a

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                206KB

                MD5

                2d19e1fc9c4e340fae4690452591dbef

                SHA1

                13408f66c25a3337ae7e6de437047267d887134b

                SHA256

                d2e105650b4a0f925bbcc2596dd5c2af964de2666914c8849ad28a2d38e05b1e

                SHA512

                9d02eac6934aed1dcdc3271d392dc02c70223482a5c1f27e2deb213b9aefa594aef4fa640f0c600331ce47a2a50e25fd7137b6e5ac76acc020f9b4f15cb6a36a

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                206KB

                MD5

                2d19e1fc9c4e340fae4690452591dbef

                SHA1

                13408f66c25a3337ae7e6de437047267d887134b

                SHA256

                d2e105650b4a0f925bbcc2596dd5c2af964de2666914c8849ad28a2d38e05b1e

                SHA512

                9d02eac6934aed1dcdc3271d392dc02c70223482a5c1f27e2deb213b9aefa594aef4fa640f0c600331ce47a2a50e25fd7137b6e5ac76acc020f9b4f15cb6a36a

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                206KB

                MD5

                2d19e1fc9c4e340fae4690452591dbef

                SHA1

                13408f66c25a3337ae7e6de437047267d887134b

                SHA256

                d2e105650b4a0f925bbcc2596dd5c2af964de2666914c8849ad28a2d38e05b1e

                SHA512

                9d02eac6934aed1dcdc3271d392dc02c70223482a5c1f27e2deb213b9aefa594aef4fa640f0c600331ce47a2a50e25fd7137b6e5ac76acc020f9b4f15cb6a36a

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                206KB

                MD5

                2d19e1fc9c4e340fae4690452591dbef

                SHA1

                13408f66c25a3337ae7e6de437047267d887134b

                SHA256

                d2e105650b4a0f925bbcc2596dd5c2af964de2666914c8849ad28a2d38e05b1e

                SHA512

                9d02eac6934aed1dcdc3271d392dc02c70223482a5c1f27e2deb213b9aefa594aef4fa640f0c600331ce47a2a50e25fd7137b6e5ac76acc020f9b4f15cb6a36a

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/1216-195-0x0000000009100000-0x00000000092C2000-memory.dmp

                Filesize

                1.8MB

              • memory/1216-196-0x0000000009800000-0x0000000009D2C000-memory.dmp

                Filesize

                5.2MB

              • memory/1216-194-0x0000000008750000-0x00000000087C6000-memory.dmp

                Filesize

                472KB

              • memory/1216-193-0x0000000008650000-0x00000000086A0000-memory.dmp

                Filesize

                320KB

              • memory/1216-192-0x00000000085B0000-0x0000000008642000-memory.dmp

                Filesize

                584KB

              • memory/1216-191-0x00000000079D0000-0x0000000007A36000-memory.dmp

                Filesize

                408KB

              • memory/1216-190-0x0000000007730000-0x0000000007740000-memory.dmp

                Filesize

                64KB

              • memory/1216-189-0x0000000007690000-0x00000000076CC000-memory.dmp

                Filesize

                240KB

              • memory/1216-197-0x0000000008F30000-0x0000000008F4E000-memory.dmp

                Filesize

                120KB

              • memory/1216-188-0x0000000007760000-0x000000000786A000-memory.dmp

                Filesize

                1.0MB

              • memory/1216-185-0x0000000000900000-0x0000000000928000-memory.dmp

                Filesize

                160KB

              • memory/1216-186-0x0000000007B90000-0x00000000081A8000-memory.dmp

                Filesize

                6.1MB

              • memory/1216-187-0x0000000007630000-0x0000000007642000-memory.dmp

                Filesize

                72KB

              • memory/2360-159-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-180-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

                Filesize

                64KB

              • memory/2360-179-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

                Filesize

                64KB

              • memory/2360-178-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

                Filesize

                64KB

              • memory/2360-177-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-175-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-173-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-171-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-169-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-161-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-163-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-165-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-167-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-157-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-155-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-153-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-151-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-150-0x0000000004960000-0x0000000004972000-memory.dmp

                Filesize

                72KB

              • memory/2360-149-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

                Filesize

                64KB

              • memory/2360-148-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

                Filesize

                64KB

              • memory/2360-147-0x0000000004AD0000-0x0000000005074000-memory.dmp

                Filesize

                5.6MB