Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2023, 19:38

General

  • Target

    b273499aec6343f65c612152fba0838b1ab0152064fbebf271199f194c302b59.dll

  • Size

    2.6MB

  • MD5

    9f21ee7e13a9ca6e6c4c4b3fe2016854

  • SHA1

    28160f280b57d1a125b84faa6df76140cc5842ec

  • SHA256

    b273499aec6343f65c612152fba0838b1ab0152064fbebf271199f194c302b59

  • SHA512

    9afcc9e6b54a4108fef5f6e6d2e3f93e0b9a2b1b6f7b645417d8212c7166e1dc6ac0021b1e54f2c485146d1bb8d9e15c505f3fd77258e5bacebfc0e129b9775a

  • SSDEEP

    49152:ga9Rhk9RAfzlIfBWH6IkXSbtAQH9CN5NsEpXhEQTZ1lsc07POGmhd/JT4gmLDRXO:pXCUIf0V9btAiC7Nv2OP//J4gmLBN

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in System32 directory 53 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 62 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b273499aec6343f65c612152fba0838b1ab0152064fbebf271199f194c302b59.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4748
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b273499aec6343f65c612152fba0838b1ab0152064fbebf271199f194c302b59.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Users\Admin\AppData\Local\Temp\8397.tmp
        C:\Users\Admin\AppData\Local\Temp\8397.tmp
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        PID:4596

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Google\CrashReports\4c0cd166-46d2-4353-84c0-fe84e686336c.dmp

    Filesize

    34KB

    MD5

    b9635d6101cd428cf65bee02462f0e3a

    SHA1

    6122fb83ee8feb43cdfb2de2b5cc030f5da5b1fd

    SHA256

    eebd8d058ddee6a3ee7148b0f39d5785e83644a43cba65112eda0238838b43ab

    SHA512

    094b09d56563faed7a0bcd63413283bf0893d63ac0611b26018acadf9dd21989a59844d4af0019e89ea7ade22e28511cd17546a9c9f44caaf76bc3e8fa38f575

  • C:\Users\Admin\AppData\Local\Temp\8397.tmp

    Filesize

    145KB

    MD5

    c610e7ccd6859872c585b2a85d7dc992

    SHA1

    362b3d4b72e3add687c209c79b500b7c6a246d46

    SHA256

    14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

    SHA512

    8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

  • C:\Users\Admin\AppData\Local\Temp\8397.tmp

    Filesize

    145KB

    MD5

    c610e7ccd6859872c585b2a85d7dc992

    SHA1

    362b3d4b72e3add687c209c79b500b7c6a246d46

    SHA256

    14063fc61dc71b9881d75e93a587c27a6daf8779ff5255a24a042beace541041

    SHA512

    8570aad2ae8b5dcba00fc5ebf3dc0ea117e96cc88a83febd820c5811bf617a6431c1367b3eb88332f43f80b30ebe2c298c22dcc44860a075f7b41bf350236666

  • memory/1768-0-0x0000000000A80000-0x0000000000B4A000-memory.dmp

    Filesize

    808KB

  • memory/1768-1-0x0000000000A80000-0x0000000000B4A000-memory.dmp

    Filesize

    808KB