Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    79s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    14/05/2023, 16:16

General

  • Target

    tmp.exe

  • Size

    340KB

  • MD5

    a8f6a3eb27d8afa3aee2628739050bd5

  • SHA1

    51a7a706529aca5b5e6f11f49081d69b895b6342

  • SHA256

    c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

  • SHA512

    99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

  • SSDEEP

    6144:8A7O3csDSREZO2wVdHDpU+L5Vp9baED5xYE:lQpgGCHLfyEV6

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 10 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "tmp" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\tmp.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\tmp.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\tmp.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:912
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:472
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:588
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "tmp" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\tmp.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:1392
        • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe
          "C:\Users\Admin\AppData\Local\Nvidia\tmp.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1092
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 1092 -s 1956
            4⤵
            • Program crash
            PID:912
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {B013146E-46D4-4EB5-83CD-3648AD9657EA} S-1-5-21-2647223082-2067913677-935928954-1000:BPOQNXYB\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe
        C:\Users\Admin\AppData\Local\Nvidia\tmp.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2028
      • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe
        C:\Users\Admin\AppData\Local\Nvidia\tmp.exe
        2⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:316
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 316 -s 2736
          3⤵
          • Program crash
          PID:2276

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      62KB

      MD5

      3ac860860707baaf32469fa7cc7c0192

      SHA1

      c33c2acdaba0e6fa41fd2f00f186804722477639

      SHA256

      d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

      SHA512

      d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      62KB

      MD5

      3ac860860707baaf32469fa7cc7c0192

      SHA1

      c33c2acdaba0e6fa41fd2f00f186804722477639

      SHA256

      d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

      SHA512

      d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      08de1970d406ab86106b90ac6f493f8b

      SHA1

      bb8a57df267ea79dcda2096241ea81d7f5ace3ce

      SHA256

      e7edd9c86154bbea64e84eb34f31f48a4fcf6bf0834cc7f61df016a2724be22c

      SHA512

      fa2464d176fc8726310d5e5e9c09ca5aeac09c8ba4ff109ad31d7d16bbfa36222c66f763a39ca97ae5e5a9e1a32cc3e4911cfb32bf9c1e2f88266f44b4326b3d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      44539359905acdd8b7f14f589df6af24

      SHA1

      6b35d48ff65c748310453bd04dcf8d70a0a34b9c

      SHA256

      31dde18b5444f01744fd72d7de639ef5a924df93305679a9c5b9fd5c29dba602

      SHA512

      fb055e92efeaf3686551b41d65ae0d8743282d6ead84236d3fd66b01baa5077b578e534c9e61eb666324885ab6a82b1fa00ebd6faa770918fffbd2613a6d80c4

    • C:\Users\Admin\AppData\Local\4lvc42u3cs\port.dat

      Filesize

      4B

      MD5

      1f2b325dcdaf12a68ed498273206d263

      SHA1

      7b13867527b1f1058c8edaf1cc996580db98a08b

      SHA256

      c7d0562cd4f65e47d51c9d68a3fde65b76e6eb8865306c94293ca22e33ed1372

      SHA512

      b59e7f8a93e34db396fe9fd384d0ee73e5ea51c64b16c56ab6a38e5851458e9233ea32611132770a4e059771ae2052d8dc7a4185ee4a141be0956c85e1a14042

    • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe

      Filesize

      340KB

      MD5

      a8f6a3eb27d8afa3aee2628739050bd5

      SHA1

      51a7a706529aca5b5e6f11f49081d69b895b6342

      SHA256

      c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

      SHA512

      99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

    • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe

      Filesize

      340KB

      MD5

      a8f6a3eb27d8afa3aee2628739050bd5

      SHA1

      51a7a706529aca5b5e6f11f49081d69b895b6342

      SHA256

      c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

      SHA512

      99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

    • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe

      Filesize

      340KB

      MD5

      a8f6a3eb27d8afa3aee2628739050bd5

      SHA1

      51a7a706529aca5b5e6f11f49081d69b895b6342

      SHA256

      c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

      SHA512

      99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

    • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe

      Filesize

      340KB

      MD5

      a8f6a3eb27d8afa3aee2628739050bd5

      SHA1

      51a7a706529aca5b5e6f11f49081d69b895b6342

      SHA256

      c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

      SHA512

      99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

    • C:\Users\Admin\AppData\Local\Temp\Tar4350.tmp

      Filesize

      164KB

      MD5

      4ff65ad929cd9a367680e0e5b1c08166

      SHA1

      c0af0d4396bd1f15c45f39d3b849ba444233b3a2

      SHA256

      c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

      SHA512

      f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

    • memory/1092-125-0x000000001B210000-0x000000001B290000-memory.dmp

      Filesize

      512KB

    • memory/1092-63-0x000000001B210000-0x000000001B290000-memory.dmp

      Filesize

      512KB

    • memory/1092-61-0x0000000001370000-0x00000000013CA000-memory.dmp

      Filesize

      360KB

    • memory/1760-54-0x0000000000FD0000-0x000000000102A000-memory.dmp

      Filesize

      360KB

    • memory/1760-57-0x000000001B1D0000-0x000000001B250000-memory.dmp

      Filesize

      512KB