Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2023, 19:30

General

  • Target

    a6f9ee100615c19f719355bb96b381b92825a3d7fc23aa05e9f8d441a095ebdb.exe

  • Size

    25KB

  • MD5

    ad9ff7aa64eda319128bece3a71f0ca5

  • SHA1

    89b60f90496140c988ed805e68871a3b96936725

  • SHA256

    a6f9ee100615c19f719355bb96b381b92825a3d7fc23aa05e9f8d441a095ebdb

  • SHA512

    3a4e859e1ecf3cff44c8ccf0c554769a21cf5a6d4863e7456d934db82a42051d983233a4a2a90a5af3ed0b233ce3686936b64ed6696bc45484e69a41f0a767e7

  • SSDEEP

    384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvB:8Q3LotOPNSQVwVVxGKEvKHrVB

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6f9ee100615c19f719355bb96b381b92825a3d7fc23aa05e9f8d441a095ebdb.exe
    "C:\Users\Admin\AppData\Local\Temp\a6f9ee100615c19f719355bb96b381b92825a3d7fc23aa05e9f8d441a095ebdb.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\spoolsv.exe
      "C:\Windows\spoolsv.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:3056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Vlwzg39L85IlLea.exe

    Filesize

    25KB

    MD5

    a60ffa868c2fcb2f4b73c89d4cf370c7

    SHA1

    0804bf5791b764e98a7fb84ed7e5ed4b2cfeb985

    SHA256

    06aabf9390db495209283f52084fea865f99605ba547b4c0d87535dfa863b50b

    SHA512

    cd058c4377afa0a45b0506235b57a79f2e69ce78d67b20111584de89a38e4b910c49d583d6f319e87dc345c81e00d5adf9b5e5892c2a5f2b51e82f18360bcac9

  • C:\Users\Admin\AppData\Local\Temp\Vlwzg39L85IlLea.exe

    Filesize

    25KB

    MD5

    a60ffa868c2fcb2f4b73c89d4cf370c7

    SHA1

    0804bf5791b764e98a7fb84ed7e5ed4b2cfeb985

    SHA256

    06aabf9390db495209283f52084fea865f99605ba547b4c0d87535dfa863b50b

    SHA512

    cd058c4377afa0a45b0506235b57a79f2e69ce78d67b20111584de89a38e4b910c49d583d6f319e87dc345c81e00d5adf9b5e5892c2a5f2b51e82f18360bcac9

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb