Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    24s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    05/06/2023, 11:51

General

  • Target

    8bf0cbb5b963ffc99f22a1f2f07ad7f9.exe

  • Size

    142.1MB

  • MD5

    8bf0cbb5b963ffc99f22a1f2f07ad7f9

  • SHA1

    ae951f16951f1ce4622e983777a41b0484541bff

  • SHA256

    cc1fdba620b3d9b5af6b84c18b7ddccd015b8edf15ed3201217876cc567b9fde

  • SHA512

    6618893a7eb2fa8438b37d33f54739f78059f0629332d3c7185198cb24f8a5f9274bd98ffe69403b6f9d4b48f1e9b3240f00540a93a77092ef80f08c65ba26d2

  • SSDEEP

    1572864:RT+YIKHhXB9oU0TEmLVA1CwByG6N+twVhB:xzFL1CRNK2

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bf0cbb5b963ffc99f22a1f2f07ad7f9.exe
    "C:\Users\Admin\AppData\Local\Temp\8bf0cbb5b963ffc99f22a1f2f07ad7f9.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1560
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 1908
      2⤵
      • Program crash
      PID:1488

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6a8af63ca3fbc1bb14108f4f4a73cdca

    SHA1

    3ff69e56e01aed2a8b5950b1ca8cafd0af454dec

    SHA256

    eb18de75922862e6fc45616f2b09a5abf3a54444c26a290d5c9b8c4e93f9a391

    SHA512

    094934dc60d75fc836fd2fba32e233e6ad4fa15697c4c817c2a2e5e2993527a79c46d7d2555234f91936e76ba7e31c21366fc8ba8c7a230252b219fe7ac45f38

  • C:\Users\Admin\AppData\Local\Temp\Cab546A.tmp

    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

  • C:\Users\Admin\AppData\Local\Temp\Tar5645.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • memory/1560-90-0x0000000006510000-0x00000000065A6000-memory.dmp

    Filesize

    600KB

  • memory/1560-93-0x0000000006510000-0x00000000065A6000-memory.dmp

    Filesize

    600KB

  • memory/1560-66-0x0000000005E80000-0x000000000600E000-memory.dmp

    Filesize

    1.6MB

  • memory/1560-70-0x0000000000A60000-0x0000000000A90000-memory.dmp

    Filesize

    192KB

  • memory/1560-69-0x0000000005E80000-0x000000000600E000-memory.dmp

    Filesize

    1.6MB

  • memory/1560-73-0x0000000000A60000-0x0000000000A90000-memory.dmp

    Filesize

    192KB

  • memory/1560-74-0x0000000006680000-0x00000000069D6000-memory.dmp

    Filesize

    3.3MB

  • memory/1560-77-0x0000000006680000-0x00000000069D6000-memory.dmp

    Filesize

    3.3MB

  • memory/1560-78-0x00000000063C0000-0x0000000006465000-memory.dmp

    Filesize

    660KB

  • memory/1560-82-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

    Filesize

    84KB

  • memory/1560-81-0x00000000063C0000-0x0000000006465000-memory.dmp

    Filesize

    660KB

  • memory/1560-85-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

    Filesize

    84KB

  • memory/1560-86-0x0000000006310000-0x0000000006364000-memory.dmp

    Filesize

    336KB

  • memory/1560-89-0x0000000006310000-0x0000000006364000-memory.dmp

    Filesize

    336KB

  • memory/1560-54-0x0000000006B30000-0x00000000074B9000-memory.dmp

    Filesize

    9.5MB

  • memory/1560-65-0x0000000008AC0000-0x00000000096A9000-memory.dmp

    Filesize

    11.9MB

  • memory/1560-94-0x0000000000E10000-0x0000000000E79000-memory.dmp

    Filesize

    420KB

  • memory/1560-97-0x0000000000E10000-0x0000000000E79000-memory.dmp

    Filesize

    420KB

  • memory/1560-101-0x0000000000D90000-0x0000000000DCC000-memory.dmp

    Filesize

    240KB

  • memory/1560-98-0x0000000000D90000-0x0000000000DCC000-memory.dmp

    Filesize

    240KB

  • memory/1560-102-0x0000000002CD0000-0x0000000002CE2000-memory.dmp

    Filesize

    72KB

  • memory/1560-105-0x0000000002CD0000-0x0000000002CE2000-memory.dmp

    Filesize

    72KB

  • memory/1560-106-0x0000000002CB0000-0x0000000002CB6000-memory.dmp

    Filesize

    24KB

  • memory/1560-109-0x0000000002CB0000-0x0000000002CB6000-memory.dmp

    Filesize

    24KB

  • memory/1560-110-0x0000000000B10000-0x0000000000B1C000-memory.dmp

    Filesize

    48KB

  • memory/1560-113-0x0000000000B10000-0x0000000000B1C000-memory.dmp

    Filesize

    48KB

  • memory/1560-114-0x0000000006470000-0x00000000064AA000-memory.dmp

    Filesize

    232KB

  • memory/1560-117-0x0000000006470000-0x00000000064AA000-memory.dmp

    Filesize

    232KB

  • memory/1560-62-0x0000000008AC0000-0x00000000096A9000-memory.dmp

    Filesize

    11.9MB

  • memory/1560-61-0x00000000009D0000-0x00000000009D9000-memory.dmp

    Filesize

    36KB

  • memory/1560-58-0x00000000009D0000-0x00000000009D9000-memory.dmp

    Filesize

    36KB

  • memory/1560-57-0x0000000006B30000-0x00000000074B9000-memory.dmp

    Filesize

    9.5MB