Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 11:41

General

  • Target

    a406a7aa00cac8bfe7f546106e935657c81f9e0db6326cc15ce1d7620d1748b1.exe

  • Size

    426KB

  • MD5

    e13ae6366b4ff48d3fecd64d149c548c

  • SHA1

    fac913d50613107616314d233e6196b7290b9ba1

  • SHA256

    a406a7aa00cac8bfe7f546106e935657c81f9e0db6326cc15ce1d7620d1748b1

  • SHA512

    f7611a542b89db8915346e7dcc66f1dd69516d28a1a8c654b29125763d5d8e531441a8c86d73bec336e5bc7c148bde9c7fbe26c5198813b93934e3f51f80cfe6

  • SSDEEP

    6144:0Kpgz97qL+QCL1el13yzPgAfmuR0NQIL1YcwJv8vjVqjeZFZwlYK:xY97qL9C56WgUHxUYcSvWqjSFZbK

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a406a7aa00cac8bfe7f546106e935657c81f9e0db6326cc15ce1d7620d1748b1.exe
    "C:\Users\Admin\AppData\Local\Temp\a406a7aa00cac8bfe7f546106e935657c81f9e0db6326cc15ce1d7620d1748b1.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4668
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 2072
      2⤵
      • Program crash
      PID:2840
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4668 -ip 4668
    1⤵
      PID:384

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4668-134-0x0000000000A80000-0x0000000000AC6000-memory.dmp

      Filesize

      280KB

    • memory/4668-135-0x0000000005020000-0x00000000055C4000-memory.dmp

      Filesize

      5.6MB

    • memory/4668-136-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-139-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-137-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-141-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-143-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-145-0x0000000005010000-0x0000000005020000-memory.dmp

      Filesize

      64KB

    • memory/4668-147-0x0000000005010000-0x0000000005020000-memory.dmp

      Filesize

      64KB

    • memory/4668-146-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-149-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-151-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-153-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-155-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-159-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-157-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-161-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-163-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-165-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-167-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-169-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-171-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-173-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-175-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-177-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-179-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-181-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-183-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-185-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-187-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-189-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-191-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-195-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-193-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-197-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-199-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-201-0x0000000004E30000-0x0000000004E65000-memory.dmp

      Filesize

      212KB

    • memory/4668-930-0x0000000007950000-0x0000000007F68000-memory.dmp

      Filesize

      6.1MB

    • memory/4668-931-0x0000000007F80000-0x0000000007F92000-memory.dmp

      Filesize

      72KB

    • memory/4668-932-0x0000000007FA0000-0x00000000080AA000-memory.dmp

      Filesize

      1.0MB

    • memory/4668-933-0x00000000080C0000-0x00000000080FC000-memory.dmp

      Filesize

      240KB

    • memory/4668-934-0x0000000005010000-0x0000000005020000-memory.dmp

      Filesize

      64KB

    • memory/4668-935-0x00000000083D0000-0x0000000008436000-memory.dmp

      Filesize

      408KB

    • memory/4668-936-0x0000000009240000-0x00000000092D2000-memory.dmp

      Filesize

      584KB

    • memory/4668-937-0x0000000004950000-0x00000000049C6000-memory.dmp

      Filesize

      472KB

    • memory/4668-938-0x0000000009430000-0x000000000944E000-memory.dmp

      Filesize

      120KB

    • memory/4668-939-0x00000000094F0000-0x0000000009540000-memory.dmp

      Filesize

      320KB

    • memory/4668-941-0x0000000009740000-0x0000000009902000-memory.dmp

      Filesize

      1.8MB

    • memory/4668-942-0x0000000009910000-0x0000000009E3C000-memory.dmp

      Filesize

      5.2MB

    • memory/4668-943-0x0000000005010000-0x0000000005020000-memory.dmp

      Filesize

      64KB

    • memory/4668-944-0x0000000005010000-0x0000000005020000-memory.dmp

      Filesize

      64KB

    • memory/4668-945-0x0000000005010000-0x0000000005020000-memory.dmp

      Filesize

      64KB