Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

20/07/2023, 09:07

230720-k3sx7sfd4w 7

20/07/2023, 09:04

230720-k12gkaef72 7

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2023, 09:04

General

  • Target

    TTWireConfirmation_20230720 pdf.exe

  • Size

    40KB

  • MD5

    6577e3088e19e789d8cdc328c5c5fe21

  • SHA1

    dabd810e66018ff0b27c891f358fe413e8891fbd

  • SHA256

    177f753bd39be134d1eb4298663f3dfc9d6291a9d6ed56df851604800ae0d5b6

  • SHA512

    f685c5f09f5be1ec031ba3e4e2990e34b5fa5063e5290da36ac3669f591fffc9a3f95e04bd00ea1e77e68692ae270756438a70dd836291f4e96ed33addb49d0f

  • SSDEEP

    768:LZzeRDK3EaC8l2hP3SScNY8cfRqTuM+1+I:LZzCDK3Eaqh36G8BTugI

Malware Config

Signatures

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TTWireConfirmation_20230720 pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\TTWireConfirmation_20230720 pdf.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Users\Admin\AppData\Local\Temp\TTWireConfirmation_20230720 pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\TTWireConfirmation_20230720 pdf.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2292

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    13f4211b8ffdabfd035cb6b0de3d9310

    SHA1

    836555fd17a07f8c05ae1482c019c296f3a8702f

    SHA256

    766a147db9cfe516b3f875c0e2b5e15841b121bc64a7bd51a5734e70287c1bc6

    SHA512

    c678d48d7bb568b19f0b0466aa4706916bc94e92f4bddf33d7d7ed1349376702f420f0785241fc08ff51a573e5506713603cae8a774ef7794a11b8f88cd90d5b

  • C:\Users\Admin\AppData\Local\Temp\Cab828A.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar8339.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • memory/1692-54-0x00000000000C0000-0x00000000000D0000-memory.dmp

    Filesize

    64KB

  • memory/1692-55-0x0000000074020000-0x000000007470E000-memory.dmp

    Filesize

    6.9MB

  • memory/1692-56-0x0000000000250000-0x0000000000290000-memory.dmp

    Filesize

    256KB

  • memory/1692-118-0x0000000005EC0000-0x0000000005FA0000-memory.dmp

    Filesize

    896KB

  • memory/1692-120-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-119-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-122-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-124-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-126-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-128-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-130-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-132-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-134-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-136-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-138-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-140-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-142-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-146-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-144-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-148-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-150-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-152-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-154-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-156-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-158-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-160-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-162-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-164-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-166-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-168-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-170-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-172-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-174-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-176-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-178-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-180-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-182-0x0000000005EC0000-0x0000000005F9A000-memory.dmp

    Filesize

    872KB

  • memory/1692-686-0x0000000074020000-0x000000007470E000-memory.dmp

    Filesize

    6.9MB

  • memory/1692-796-0x0000000000250000-0x0000000000290000-memory.dmp

    Filesize

    256KB

  • memory/1692-1443-0x00000000004D0000-0x00000000004D1000-memory.dmp

    Filesize

    4KB

  • memory/1692-1444-0x0000000004410000-0x0000000004456000-memory.dmp

    Filesize

    280KB

  • memory/1692-1445-0x0000000004EE0000-0x0000000004F2C000-memory.dmp

    Filesize

    304KB

  • memory/1692-1457-0x0000000074020000-0x000000007470E000-memory.dmp

    Filesize

    6.9MB

  • memory/2292-1462-0x0000000073110000-0x00000000737FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2292-1461-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2292-1463-0x0000000000530000-0x0000000000570000-memory.dmp

    Filesize

    256KB

  • memory/2292-1464-0x0000000073110000-0x00000000737FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2292-1465-0x0000000000530000-0x0000000000570000-memory.dmp

    Filesize

    256KB