Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    20/09/2023, 18:42

General

  • Target

    0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe

  • Size

    25KB

  • MD5

    b4115c42d68232ae004a3e4043f2ffbb

  • SHA1

    fc3258270ea4befab364dfcad69a065aad418ae4

  • SHA256

    0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c

  • SHA512

    6fb14352d32af2ea240392858d3f18428038265885621dfefd421980c4c573702f542d6098680c8ef29ff6bd87080a4aa2f5bd3a634ae8eb2f083893b2411527

  • SSDEEP

    384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvB:8Q3LotOPNSQVwVVxGKEvKHrVB

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe
    "C:\Users\Admin\AppData\Local\Temp\0a295cb15ccc6e74cb97dcf189fa29f24142e09660233daffeff6cb5fb77f39c.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Windows\spoolsv.exe
      "C:\Windows\spoolsv.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2bI5StROF8DT2ZF.exe

    Filesize

    25KB

    MD5

    b91688c4167669259d4f15454041f416

    SHA1

    0d52f3fdfba3fcfde636d742285a32400566776c

    SHA256

    f81b32a7e8db8e68f4c50d915823137f5b90c6a651bd1ce7865573188acbaad3

    SHA512

    f8d84dea5dd5a629245a880b79fc6980cc90132a13bd3107a23531dad4a7ca3ad966fea58ef618a48172ca39bb213fb60acc923dfcca7396791da56f257f3621

  • C:\Users\Admin\AppData\Local\Temp\4184430216\zmstage.exe

    Filesize

    5.1MB

    MD5

    de27d56c8f901fef5e9dfeeecd8824a7

    SHA1

    edda01b47e1f7c27ca6a1d28cf2ebc02d02bb74c

    SHA256

    36ce95d2eac9fdfb59c53c22634b134b27ad7f213afb54c3b7b8ea92d7c70a51

    SHA512

    f997dd779748c9931120ceda8845dc28b1250e875ac073700243d0838279ce19591ec587973abc808344b39b1a93790dfab57cbc4eeb8539394922ed2cef6720

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb