Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
05/05/2023, 19:02
Static task
static1
General
-
Target
32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe
-
Size
479KB
-
MD5
bae7a0ee2dfdd0d7498a60b1c064266c
-
SHA1
d283d3e0014e86c3e48e562626dc2d88328ff0ac
-
SHA256
32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804
-
SHA512
40bedd2134a7587561b4cde7eab6188e48bcbca317f62e62ce661a8e0265aba1b9cc0676c8d2eaf57584b2640817dca8997e0729d46a5211110df4311f201528
-
SSDEEP
12288:aMrny90VeBItbxjPbkzjnkW8oebL/oFFmH/VfSA:NyZBIxxDQzfbHmH9fSA
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a4667757.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a4667757.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a4667757.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a4667757.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a4667757.exe -
Executes dropped EXE 7 IoCs
pid Process 2416 v3271273.exe 2676 a4667757.exe 4664 b2092750.exe 1312 d2720036.exe 4740 oneetx.exe 4416 oneetx.exe 1420 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3340 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a4667757.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a4667757.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce v3271273.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v3271273.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4748 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2676 a4667757.exe 2676 a4667757.exe 4664 b2092750.exe 4664 b2092750.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2676 a4667757.exe Token: SeDebugPrivilege 4664 b2092750.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1312 d2720036.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2416 2140 32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe 66 PID 2140 wrote to memory of 2416 2140 32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe 66 PID 2140 wrote to memory of 2416 2140 32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe 66 PID 2416 wrote to memory of 2676 2416 v3271273.exe 67 PID 2416 wrote to memory of 2676 2416 v3271273.exe 67 PID 2416 wrote to memory of 2676 2416 v3271273.exe 67 PID 2416 wrote to memory of 4664 2416 v3271273.exe 68 PID 2416 wrote to memory of 4664 2416 v3271273.exe 68 PID 2416 wrote to memory of 4664 2416 v3271273.exe 68 PID 2140 wrote to memory of 1312 2140 32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe 70 PID 2140 wrote to memory of 1312 2140 32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe 70 PID 2140 wrote to memory of 1312 2140 32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe 70 PID 1312 wrote to memory of 4740 1312 d2720036.exe 71 PID 1312 wrote to memory of 4740 1312 d2720036.exe 71 PID 1312 wrote to memory of 4740 1312 d2720036.exe 71 PID 4740 wrote to memory of 4748 4740 oneetx.exe 72 PID 4740 wrote to memory of 4748 4740 oneetx.exe 72 PID 4740 wrote to memory of 4748 4740 oneetx.exe 72 PID 4740 wrote to memory of 3812 4740 oneetx.exe 74 PID 4740 wrote to memory of 3812 4740 oneetx.exe 74 PID 4740 wrote to memory of 3812 4740 oneetx.exe 74 PID 3812 wrote to memory of 4696 3812 cmd.exe 76 PID 3812 wrote to memory of 4696 3812 cmd.exe 76 PID 3812 wrote to memory of 4696 3812 cmd.exe 76 PID 3812 wrote to memory of 2868 3812 cmd.exe 77 PID 3812 wrote to memory of 2868 3812 cmd.exe 77 PID 3812 wrote to memory of 2868 3812 cmd.exe 77 PID 3812 wrote to memory of 440 3812 cmd.exe 78 PID 3812 wrote to memory of 440 3812 cmd.exe 78 PID 3812 wrote to memory of 440 3812 cmd.exe 78 PID 3812 wrote to memory of 3892 3812 cmd.exe 79 PID 3812 wrote to memory of 3892 3812 cmd.exe 79 PID 3812 wrote to memory of 3892 3812 cmd.exe 79 PID 3812 wrote to memory of 1628 3812 cmd.exe 80 PID 3812 wrote to memory of 1628 3812 cmd.exe 80 PID 3812 wrote to memory of 1628 3812 cmd.exe 80 PID 3812 wrote to memory of 3664 3812 cmd.exe 81 PID 3812 wrote to memory of 3664 3812 cmd.exe 81 PID 3812 wrote to memory of 3664 3812 cmd.exe 81 PID 4740 wrote to memory of 3340 4740 oneetx.exe 83 PID 4740 wrote to memory of 3340 4740 oneetx.exe 83 PID 4740 wrote to memory of 3340 4740 oneetx.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe"C:\Users\Admin\AppData\Local\Temp\32e115144b2e2d977a7f07e9e26ec91088358e0907cbca1eaf5d4ecb2ab5d804.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3271273.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3271273.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4667757.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4667757.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2092750.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b2092750.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2720036.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d2720036.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:4748
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4696
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵PID:2868
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵PID:440
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3892
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:N"5⤵PID:1628
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\c3912af058" /P "Admin:R" /E5⤵PID:3664
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:3340
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:4416
-
C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exeC:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe1⤵
- Executes dropped EXE
PID:1420
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD56bec18d88886233f07b218c2c676844e
SHA1871ce83c57d34de8d40a45bd6f97122b6a6273c0
SHA25675afa6fe94d27ef4d1aa33ab28946715dcefbdd92ad11a1648162c13cc61e29e
SHA512480cd7968e3a3bb80f6aed87064df39ff6869aa71cc87b3d7f3ed3c33722dc087ee239329b3470dcc26ae4b94ab7d63c8852e33baba8df0fa204b2a937f22d52
-
Filesize
206KB
MD56bec18d88886233f07b218c2c676844e
SHA1871ce83c57d34de8d40a45bd6f97122b6a6273c0
SHA25675afa6fe94d27ef4d1aa33ab28946715dcefbdd92ad11a1648162c13cc61e29e
SHA512480cd7968e3a3bb80f6aed87064df39ff6869aa71cc87b3d7f3ed3c33722dc087ee239329b3470dcc26ae4b94ab7d63c8852e33baba8df0fa204b2a937f22d52
-
Filesize
308KB
MD53367c2bc07dec7959748e4ce7cc038b6
SHA118ace02c783f169d6e44c07e704b928344db9db1
SHA256c2d7a6f86442d1c88e0542d1097100dd7c2bbbd13b1538895a8452104f8e3681
SHA5129f0dca35b1631d124a929badd6ab46d60c77ac0aabc469eeb538330b08db3b19d801ba78b72962b42a10a07ac3ace7331cd08c217319c55daa70bf4dd1ad8c3c
-
Filesize
308KB
MD53367c2bc07dec7959748e4ce7cc038b6
SHA118ace02c783f169d6e44c07e704b928344db9db1
SHA256c2d7a6f86442d1c88e0542d1097100dd7c2bbbd13b1538895a8452104f8e3681
SHA5129f0dca35b1631d124a929badd6ab46d60c77ac0aabc469eeb538330b08db3b19d801ba78b72962b42a10a07ac3ace7331cd08c217319c55daa70bf4dd1ad8c3c
-
Filesize
175KB
MD50c34cb1fbe07157c064c78685541975a
SHA15a8f7900c748a0495c8f7480633e9b0d5a452224
SHA256c4b9bffb51c0ae456a177ae2f11f0ecc436b744a10ff99c34fd320c22060f5a3
SHA51267fccafa4898da3cf2c95fd9171e84734105ecfe98c4b94b36195f113fef681cf69345f1aa27f2664e314114243004fbc2c7bb258e8335792e56f068d06f0a0c
-
Filesize
175KB
MD50c34cb1fbe07157c064c78685541975a
SHA15a8f7900c748a0495c8f7480633e9b0d5a452224
SHA256c4b9bffb51c0ae456a177ae2f11f0ecc436b744a10ff99c34fd320c22060f5a3
SHA51267fccafa4898da3cf2c95fd9171e84734105ecfe98c4b94b36195f113fef681cf69345f1aa27f2664e314114243004fbc2c7bb258e8335792e56f068d06f0a0c
-
Filesize
136KB
MD5ff5bd7ba1fc30a6123534c1dd4e4acfe
SHA105e91a5b5617dc3c24942e5d8d91807263426fea
SHA25693baecbaaaf08ad184990cc3b258d161c668a3fada9429090e60c965707c31fe
SHA51234ee81a79ad17122b83c394de5c64d3ee3bac6438c0bd6c965882192ca17653f549261e4d9880ca25bd84b0dd493c202c20cff1ad4645400f7b10120c1050110
-
Filesize
136KB
MD5ff5bd7ba1fc30a6123534c1dd4e4acfe
SHA105e91a5b5617dc3c24942e5d8d91807263426fea
SHA25693baecbaaaf08ad184990cc3b258d161c668a3fada9429090e60c965707c31fe
SHA51234ee81a79ad17122b83c394de5c64d3ee3bac6438c0bd6c965882192ca17653f549261e4d9880ca25bd84b0dd493c202c20cff1ad4645400f7b10120c1050110
-
Filesize
206KB
MD56bec18d88886233f07b218c2c676844e
SHA1871ce83c57d34de8d40a45bd6f97122b6a6273c0
SHA25675afa6fe94d27ef4d1aa33ab28946715dcefbdd92ad11a1648162c13cc61e29e
SHA512480cd7968e3a3bb80f6aed87064df39ff6869aa71cc87b3d7f3ed3c33722dc087ee239329b3470dcc26ae4b94ab7d63c8852e33baba8df0fa204b2a937f22d52
-
Filesize
206KB
MD56bec18d88886233f07b218c2c676844e
SHA1871ce83c57d34de8d40a45bd6f97122b6a6273c0
SHA25675afa6fe94d27ef4d1aa33ab28946715dcefbdd92ad11a1648162c13cc61e29e
SHA512480cd7968e3a3bb80f6aed87064df39ff6869aa71cc87b3d7f3ed3c33722dc087ee239329b3470dcc26ae4b94ab7d63c8852e33baba8df0fa204b2a937f22d52
-
Filesize
206KB
MD56bec18d88886233f07b218c2c676844e
SHA1871ce83c57d34de8d40a45bd6f97122b6a6273c0
SHA25675afa6fe94d27ef4d1aa33ab28946715dcefbdd92ad11a1648162c13cc61e29e
SHA512480cd7968e3a3bb80f6aed87064df39ff6869aa71cc87b3d7f3ed3c33722dc087ee239329b3470dcc26ae4b94ab7d63c8852e33baba8df0fa204b2a937f22d52
-
Filesize
206KB
MD56bec18d88886233f07b218c2c676844e
SHA1871ce83c57d34de8d40a45bd6f97122b6a6273c0
SHA25675afa6fe94d27ef4d1aa33ab28946715dcefbdd92ad11a1648162c13cc61e29e
SHA512480cd7968e3a3bb80f6aed87064df39ff6869aa71cc87b3d7f3ed3c33722dc087ee239329b3470dcc26ae4b94ab7d63c8852e33baba8df0fa204b2a937f22d52
-
Filesize
206KB
MD56bec18d88886233f07b218c2c676844e
SHA1871ce83c57d34de8d40a45bd6f97122b6a6273c0
SHA25675afa6fe94d27ef4d1aa33ab28946715dcefbdd92ad11a1648162c13cc61e29e
SHA512480cd7968e3a3bb80f6aed87064df39ff6869aa71cc87b3d7f3ed3c33722dc087ee239329b3470dcc26ae4b94ab7d63c8852e33baba8df0fa204b2a937f22d52
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
89KB
MD58451a2c5daa42b25333b1b2089c5ea39
SHA1700cc99ec8d3113435e657070d2d6bde0a833adc
SHA256b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0
SHA5126d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53