Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
Resource
win7-20230712-en
General
-
Target
e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe
-
Size
620KB
-
MD5
159d5fc953b4f50ba36c98edd6fd6c81
-
SHA1
ee0a0d42ea26dab26f9e71483f5e6537e74934a6
-
SHA256
e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3
-
SHA512
10a54fa8bbedb0136d7e8748c93b121ea5a8dc1dbf1fbc4e6d5a76c5637c59b9853b6144ee79fe4454b430eeb4fef52a8d73a590db14533ae8bf3c2f6fabb952
-
SSDEEP
12288:v0Dl+C42xjWYXEsWYGzxfk+PdnBGFaSj29jwX9np3BkA+5CTXgJT1HLE+tki:gTXwY6xH1nu+wXrBkA+5eQJTVLE+t
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3292 set thread context of 2064 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5020 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 3896 powershell.exe 1968 powershell.exe 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 3896 powershell.exe 2064 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 2064 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 1968 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe Token: SeDebugPrivilege 3896 powershell.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeDebugPrivilege 2064 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3292 wrote to memory of 1968 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 90 PID 3292 wrote to memory of 1968 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 90 PID 3292 wrote to memory of 1968 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 90 PID 3292 wrote to memory of 3896 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 92 PID 3292 wrote to memory of 3896 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 92 PID 3292 wrote to memory of 3896 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 92 PID 3292 wrote to memory of 5020 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 94 PID 3292 wrote to memory of 5020 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 94 PID 3292 wrote to memory of 5020 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 94 PID 3292 wrote to memory of 4964 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 96 PID 3292 wrote to memory of 4964 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 96 PID 3292 wrote to memory of 4964 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 96 PID 3292 wrote to memory of 2064 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 97 PID 3292 wrote to memory of 2064 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 97 PID 3292 wrote to memory of 2064 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 97 PID 3292 wrote to memory of 2064 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 97 PID 3292 wrote to memory of 2064 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 97 PID 3292 wrote to memory of 2064 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 97 PID 3292 wrote to memory of 2064 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 97 PID 3292 wrote to memory of 2064 3292 e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\olHNjIyLhh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\olHNjIyLhh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1661.tmp"2⤵
- Creates scheduled task(s)
PID:5020
-
-
C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"2⤵PID:4964
-
-
C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"C:\Users\Admin\AppData\Local\Temp\e1d2116fbcb690a0b015961eb71ff0a942601170a3371dab1c65f965861bf6f3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD53130d060ee4af7b597f6287113dd3a32
SHA1c3ab3c46570c9e3523332185068edd3caf00edb2
SHA256407c2fddaab46591e5598bf7e1e0ac491b7589c91ac5987893eebd63d4b61b8d
SHA5122fc7d6eb250f93912fa0d486ccd87b04331fe1b79a0dad675aa587348c0a1938d77c9ff75ba6b30557291a890ba2c955cf3c0dc27a70d1ff7fe78e42d53ae13a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD59839d852f521ac12b7d9b27d08995ba4
SHA16a673016a427eed3ba64bb18138f3c918ad0665b
SHA256f971df02a51e2f0a1b00b1268d0b3a8730178fcc4e7b8a8eff456921f3573b8a
SHA5123f4015274e4f1cb7e2c2737536832ea0ed9a81c0ec5930cbe8ff185196244f2c65724025b109d84266ef8b2d14184e382d5e1c9a48f48cae8ade4d9a03e344d7