Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/08/2023, 07:08

General

  • Target

    ea17303f6dc9d21f61d9bb9558ebbe3ebc95f4d612c50fab858e7db2460d7df8.exe

  • Size

    25KB

  • MD5

    60f6e8250693d698945a9744a08aea75

  • SHA1

    c5391a4165c1df0686e7d312169c5881904a2bde

  • SHA256

    ea17303f6dc9d21f61d9bb9558ebbe3ebc95f4d612c50fab858e7db2460d7df8

  • SHA512

    e8c353f365d835ee71dda5119cd6ac52f980d1639541a8c44eaf9eca8b2514b8f0af26e3e082c9219afcef63d271d9d03e3c7641608c99820c6a0462f3335e61

  • SSDEEP

    384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjv/+Vl:8Q3LotOPNSQVwVVxGKEvKHrV2l

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea17303f6dc9d21f61d9bb9558ebbe3ebc95f4d612c50fab858e7db2460d7df8.exe
    "C:\Users\Admin\AppData\Local\Temp\ea17303f6dc9d21f61d9bb9558ebbe3ebc95f4d612c50fab858e7db2460d7df8.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\spoolsv.exe
      "C:\Windows\spoolsv.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:1076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    349KB

    MD5

    b52b2b139d128e200b9a6ae0442b25b0

    SHA1

    ef59b2b1461828144936cf5fd01435e394dec059

    SHA256

    91543fce51e1b0a22281e3213aa87a8a6f8279003dc50a2103f8f3c29c907f59

    SHA512

    f9cffe835718293d72bf78eb2a4206fe688d8d0dd1eb0045076caa53e9304d7b075cfc366b685337fe4f6558c7756ab8006b3fbf9b8e10c7e7e04a16d7a8da92

  • C:\Users\Admin\AppData\Local\Temp\TDLF8GD02OMACIq.exe

    Filesize

    25KB

    MD5

    e85618f74919ec8dc0161e08fa39904e

    SHA1

    c7a14a06aa22704226acd39a8b11639bd5c0d638

    SHA256

    b46acea9ec05e724354815194c67ee5b8a1bfda99e90171f2d9febd5d0921b8e

    SHA512

    9656da40c8777c357d610d02f7827fb5deef4914a0dff16b11224a09b404c2a31a9ec151763266d71cefb5c3d723eac4db34bd3c574917a1a5836c1eeb765200

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb