Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

20/07/2023, 09:07

230720-k3sx7sfd4w 7

20/07/2023, 09:04

230720-k12gkaef72 7

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2023, 09:04

General

  • Target

    TTWireConfirmation_20230720 pdf.exe

  • Size

    40KB

  • MD5

    6577e3088e19e789d8cdc328c5c5fe21

  • SHA1

    dabd810e66018ff0b27c891f358fe413e8891fbd

  • SHA256

    177f753bd39be134d1eb4298663f3dfc9d6291a9d6ed56df851604800ae0d5b6

  • SHA512

    f685c5f09f5be1ec031ba3e4e2990e34b5fa5063e5290da36ac3669f591fffc9a3f95e04bd00ea1e77e68692ae270756438a70dd836291f4e96ed33addb49d0f

  • SSDEEP

    768:LZzeRDK3EaC8l2hP3SScNY8cfRqTuM+1+I:LZzCDK3Eaqh36G8BTugI

Malware Config

Signatures

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TTWireConfirmation_20230720 pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\TTWireConfirmation_20230720 pdf.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\AppData\Local\Temp\TTWireConfirmation_20230720 pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\TTWireConfirmation_20230720 pdf.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:3092

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TTWireConfirmation_20230720 pdf.exe.log

    Filesize

    1KB

    MD5

    a13312e452bb67b8b110b6d7fbc6cf6f

    SHA1

    057c5cc1d9b4c48eb1cb78463d8d7599f8fd8a50

    SHA256

    d5e1315b62697659a967e9aaac291e96ab9cc7d90bab47bc30e6c338a81f479b

    SHA512

    1e60ceb2af03e9eb8a347bf0ae2e57601ca82e51ec14962eba368393da46f939ff0429d54d59c8a90fbc8f32ed71c880634e0239ccc26c86c40496acdac7b9b0

  • memory/1784-133-0x00000000002D0000-0x00000000002E0000-memory.dmp

    Filesize

    64KB

  • memory/1784-134-0x0000000075130000-0x00000000758E0000-memory.dmp

    Filesize

    7.7MB

  • memory/1784-135-0x0000000004D90000-0x0000000004DA0000-memory.dmp

    Filesize

    64KB

  • memory/1784-136-0x0000000005600000-0x0000000005622000-memory.dmp

    Filesize

    136KB

  • memory/1784-137-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-138-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-140-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-142-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-144-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-146-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-148-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-150-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-152-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-154-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-156-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-158-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-160-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-162-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-164-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-166-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-168-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-170-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-172-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-174-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-176-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-178-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-180-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-182-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-184-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-186-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-188-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-190-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-192-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-194-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-196-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-198-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-200-0x0000000005F50000-0x000000000602A000-memory.dmp

    Filesize

    872KB

  • memory/1784-924-0x0000000075130000-0x00000000758E0000-memory.dmp

    Filesize

    7.7MB

  • memory/1784-998-0x0000000004D90000-0x0000000004DA0000-memory.dmp

    Filesize

    64KB

  • memory/1784-1461-0x0000000006130000-0x0000000006131000-memory.dmp

    Filesize

    4KB

  • memory/1784-1462-0x0000000006BA0000-0x0000000007144000-memory.dmp

    Filesize

    5.6MB

  • memory/1784-1468-0x0000000075130000-0x00000000758E0000-memory.dmp

    Filesize

    7.7MB

  • memory/3092-1467-0x0000000075130000-0x00000000758E0000-memory.dmp

    Filesize

    7.7MB

  • memory/3092-1469-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/3092-1470-0x0000000003350000-0x0000000003360000-memory.dmp

    Filesize

    64KB

  • memory/3092-1471-0x00000000059A0000-0x0000000005A06000-memory.dmp

    Filesize

    408KB

  • memory/3092-1472-0x0000000006ED0000-0x0000000006F20000-memory.dmp

    Filesize

    320KB

  • memory/3092-1473-0x0000000006FC0000-0x0000000007052000-memory.dmp

    Filesize

    584KB

  • memory/3092-1474-0x0000000006F60000-0x0000000006F6A000-memory.dmp

    Filesize

    40KB

  • memory/3092-1475-0x0000000075130000-0x00000000758E0000-memory.dmp

    Filesize

    7.7MB

  • memory/3092-1476-0x0000000003350000-0x0000000003360000-memory.dmp

    Filesize

    64KB