Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/08/2023, 21:47

General

  • Target

    56e2743a76543fb61d9200e68d59aa80ee9827d6e971d91d991c6bc4bc46e339.exe

  • Size

    26KB

  • MD5

    dbe0206b23932d34dd3d3f25085c58ec

  • SHA1

    a0ad74b6108a10711bc45ba7959a65fa137ae01d

  • SHA256

    56e2743a76543fb61d9200e68d59aa80ee9827d6e971d91d991c6bc4bc46e339

  • SHA512

    1a5fe48dc753d919a230c04dc0e0b17180b05d3719b5a0adf67a70a710f9bc5d4766f1446e0a178518393c1a3cb254ee1c90cefde12e3ae8c0c9f53728af0e6d

  • SSDEEP

    384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvw/y:8Q3LotOPNSQVwVVxGKEvKHrVUy

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56e2743a76543fb61d9200e68d59aa80ee9827d6e971d91d991c6bc4bc46e339.exe
    "C:\Users\Admin\AppData\Local\Temp\56e2743a76543fb61d9200e68d59aa80ee9827d6e971d91d991c6bc4bc46e339.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\spoolsv.exe
      "C:\Windows\spoolsv.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:1116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    349KB

    MD5

    72e5434c6449e0c617305598d0f18d17

    SHA1

    c709982ac7c9d29d62e978ceb682c36d81a02a4c

    SHA256

    059bb4592e84dddd05e4380efe3182027a40cf77316d4f635e3e56a822893ad4

    SHA512

    540b94bbf737f1e1e8205dd717ac5094f69916ebc85cb1056a32d055d734b73f53587ed1c4f43ef46e8f019ea6e07a2bc5cf162ff4111fdd9017f3be2eb0b611

  • C:\Users\Admin\AppData\Local\Temp\RanjrlaPjwfdYxQ.exe

    Filesize

    26KB

    MD5

    f2da58f6c08b82e1cfe537a5d16f7390

    SHA1

    3378babf641228ed7a73df127e02cb4701bd30f0

    SHA256

    3b69b3cf3922bc1e163ec4ef7f97a4d43cf37c1bfad711e6c1b692e4ec47993b

    SHA512

    05f649af80d7a25838f192fe947263e07b58404e241d67b1241d4768a8ddc77fedea0191827b6bb987ae3e8c61eae5bb7869de2730536a80026cf5860425d247

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb