Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2023, 16:16

General

  • Target

    tmp.exe

  • Size

    340KB

  • MD5

    a8f6a3eb27d8afa3aee2628739050bd5

  • SHA1

    51a7a706529aca5b5e6f11f49081d69b895b6342

  • SHA256

    c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

  • SHA512

    99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

  • SSDEEP

    6144:8A7O3csDSREZO2wVdHDpU+L5Vp9baED5xYE:lQpgGCHLfyEV6

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "tmp" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\tmp.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\tmp.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\tmp.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4472
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:4632
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:860
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "tmp" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\tmp.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:3152
        • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe
          "C:\Users\Admin\AppData\Local\Nvidia\tmp.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:2180
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp9EE4.tmp" -C "C:\Users\Admin\AppData\Local\4lvc42u3cs"
            4⤵
              PID:4092
            • C:\Users\Admin\AppData\Local\4lvc42u3cs\tor\tor.exe
              "C:\Users\Admin\AppData\Local\4lvc42u3cs\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\4lvc42u3cs\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:1316
            • C:\Users\Admin\AppData\Local\test.exe
              "C:\Users\Admin\AppData\Local\test.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3920
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "test" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\test.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\test.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\test.exe"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4124
                • C:\Windows\system32\chcp.com
                  chcp 65001
                  6⤵
                    PID:2004
                  • C:\Windows\system32\PING.EXE
                    ping 127.0.0.1
                    6⤵
                    • Runs ping.exe
                    PID:4956
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /tn "test" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\test.exe" /rl HIGHEST /f
                    6⤵
                    • Creates scheduled task(s)
                    PID:4424
        • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe
          C:\Users\Admin\AppData\Local\Nvidia\tmp.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3680
          • C:\Users\Admin\AppData\Local\4lvc42u3cs\tor\tor.exe
            "C:\Users\Admin\AppData\Local\4lvc42u3cs\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\4lvc42u3cs\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4860
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3680 -s 2080
            2⤵
            • Program crash
            PID:2252
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 420 -p 3680 -ip 3680
          1⤵
            PID:2376
          • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe
            C:\Users\Admin\AppData\Local\Nvidia\tmp.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1544
            • C:\Users\Admin\AppData\Local\4lvc42u3cs\tor\tor.exe
              "C:\Users\Admin\AppData\Local\4lvc42u3cs\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\4lvc42u3cs\torrc.txt"
              2⤵
              • Executes dropped EXE
              PID:4892
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 1544 -s 1216
              2⤵
              • Program crash
              PID:1848
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 384 -p 1544 -ip 1544
            1⤵
              PID:2772

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\4lvc42u3cs\data\cached-microdesc-consensus.tmp

              Filesize

              2.3MB

              MD5

              d8382ff61ea0c686cdfa68e53ce6703a

              SHA1

              060a16035334029952833478783b5841388128e3

              SHA256

              8be7672f08f2d074c5a3f3e1b6ce2096c8f57292669d3514ba74260fe6e219bb

              SHA512

              8d96436cd1096293b6b77d05afecf3484a8935edde965ca51a8fe809f97bd19e39f381d347d0bdebee8096ae7df5d1097505fd0c540dc66f8b065df012054713

            • C:\Users\Admin\AppData\Local\4lvc42u3cs\data\cached-microdescs.new

              Filesize

              4.7MB

              MD5

              28152a0ac0b78a649205b14b39482250

              SHA1

              951de8e596501fa0b738deb23303eb18494add12

              SHA256

              7717c0ffccfdfb4b4fac2eb2603b246aa52550648658dce58b4064b26830238e

              SHA512

              5a7a8c5ce303c83343b4aaa02d80085318ecdde412f705968eb0c3a67c9c37825e19cfc6e5a23f63ed37154d83a82079b4bb16d4426847dbbc314a43c6e23b33

            • C:\Users\Admin\AppData\Local\4lvc42u3cs\host\hostname

              Filesize

              64B

              MD5

              1c8a08e966182853c9745bb1766c96f5

              SHA1

              8710b65910b3c0bb9b1afd7a4772ef282d43e456

              SHA256

              728d67fe7f618097617cba99fabe3ab44ed88eb27c368485f4834e84ca0ed90f

              SHA512

              e983381806c911d2618c41fb6fac2195baa459677e41df1e611cd2589851074a7651ac6dcb946fb2975db51f906225048034671a68b6932362701916ae4ea62e

            • C:\Users\Admin\AppData\Local\4lvc42u3cs\port.dat

              Filesize

              4B

              MD5

              713fd63d76c8a57b16fc433fb4ae718a

              SHA1

              ebb42ede41ae93ebdf900ad1cbf4bf6005bc504e

              SHA256

              69cddaf496b7fcb7e41296a205dad5c22498c3e005dd6c600965dbbb2c601091

              SHA512

              3b8ca94004f29f0b516a0d888b57f94bf9fdcca07c6fb9c0d34104969a29127ec128da7b852a92d7b6b8e961681431f45459f8a42aba8f8e54151734b979517a

            • C:\Users\Admin\AppData\Local\4lvc42u3cs\tor\tor.exe

              Filesize

              7.4MB

              MD5

              88590909765350c0d70c6c34b1f31dd2

              SHA1

              129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

              SHA256

              46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

              SHA512

              a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

            • C:\Users\Admin\AppData\Local\4lvc42u3cs\tor\tor.exe

              Filesize

              7.4MB

              MD5

              88590909765350c0d70c6c34b1f31dd2

              SHA1

              129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

              SHA256

              46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

              SHA512

              a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

            • C:\Users\Admin\AppData\Local\4lvc42u3cs\tor\tor.exe

              Filesize

              7.4MB

              MD5

              88590909765350c0d70c6c34b1f31dd2

              SHA1

              129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

              SHA256

              46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

              SHA512

              a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

            • C:\Users\Admin\AppData\Local\4lvc42u3cs\tor\tor.exe

              Filesize

              7.4MB

              MD5

              88590909765350c0d70c6c34b1f31dd2

              SHA1

              129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

              SHA256

              46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

              SHA512

              a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

            • C:\Users\Admin\AppData\Local\4lvc42u3cs\torrc.txt

              Filesize

              218B

              MD5

              3830d98432868fd417ef4f979a998f39

              SHA1

              ee0348e178f65bb29679c2ccccedb674f73fead6

              SHA256

              932ea8aa3d19f8938e6709101fd0b19963f55b54dc87bcd99241eb1d88a5abfb

              SHA512

              733a6ef709caa64790205e493f88e0c85fe9aca4ec99c24818aae5973cc6d73f9574322a030e711a15b908dd59f658a230c6d099ba19792af11ba34ea6cbc4c6

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\tmp.exe.log

              Filesize

              847B

              MD5

              3308a84a40841fab7dfec198b3c31af7

              SHA1

              4e7ab6336c0538be5dd7da529c0265b3b6523083

              SHA256

              169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

              SHA512

              97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

            • C:\Users\Admin\AppData\Local\Nvidia\test.exe

              Filesize

              340KB

              MD5

              a8f6a3eb27d8afa3aee2628739050bd5

              SHA1

              51a7a706529aca5b5e6f11f49081d69b895b6342

              SHA256

              c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

              SHA512

              99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

            • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe

              Filesize

              340KB

              MD5

              a8f6a3eb27d8afa3aee2628739050bd5

              SHA1

              51a7a706529aca5b5e6f11f49081d69b895b6342

              SHA256

              c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

              SHA512

              99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

            • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe

              Filesize

              340KB

              MD5

              a8f6a3eb27d8afa3aee2628739050bd5

              SHA1

              51a7a706529aca5b5e6f11f49081d69b895b6342

              SHA256

              c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

              SHA512

              99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

            • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe

              Filesize

              340KB

              MD5

              a8f6a3eb27d8afa3aee2628739050bd5

              SHA1

              51a7a706529aca5b5e6f11f49081d69b895b6342

              SHA256

              c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

              SHA512

              99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

            • C:\Users\Admin\AppData\Local\Nvidia\tmp.exe

              Filesize

              340KB

              MD5

              a8f6a3eb27d8afa3aee2628739050bd5

              SHA1

              51a7a706529aca5b5e6f11f49081d69b895b6342

              SHA256

              c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

              SHA512

              99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

            • C:\Users\Admin\AppData\Local\Temp\tmp9EE4.tmp

              Filesize

              13.3MB

              MD5

              89d2d5811c1aff539bb355f15f3ddad0

              SHA1

              5bb3577c25b6d323d927200c48cd184a3e27c873

              SHA256

              b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

              SHA512

              39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

            • C:\Users\Admin\AppData\Local\test.exe

              Filesize

              340KB

              MD5

              a8f6a3eb27d8afa3aee2628739050bd5

              SHA1

              51a7a706529aca5b5e6f11f49081d69b895b6342

              SHA256

              c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

              SHA512

              99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

            • C:\Users\Admin\AppData\Local\test.exe

              Filesize

              340KB

              MD5

              a8f6a3eb27d8afa3aee2628739050bd5

              SHA1

              51a7a706529aca5b5e6f11f49081d69b895b6342

              SHA256

              c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

              SHA512

              99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

            • C:\Users\Admin\AppData\Local\test.exe

              Filesize

              340KB

              MD5

              a8f6a3eb27d8afa3aee2628739050bd5

              SHA1

              51a7a706529aca5b5e6f11f49081d69b895b6342

              SHA256

              c24938a87190df896986a22f9f66fb84401da04cda2a535856b0ce9eacb2bd0d

              SHA512

              99e661558e45d9b6b3c3ba6986fff07d3e8c85e9ef2465d390c047640a1181561b720bf271c193467179338e22dcaf2bd6b3077fadb8436398acea1dcec49751

            • memory/1132-133-0x000002340F210000-0x000002340F26A000-memory.dmp

              Filesize

              360KB

            • memory/2180-192-0x0000029E2F760000-0x0000029E2F770000-memory.dmp

              Filesize

              64KB

            • memory/2180-142-0x0000029E2F760000-0x0000029E2F770000-memory.dmp

              Filesize

              64KB

            • memory/3680-221-0x000001D07FA70000-0x000001D07FA80000-memory.dmp

              Filesize

              64KB