Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2023, 19:02

General

  • Target

    e56c5a819b8f3ae19fab76fa55d5838152930dcc74d60fbbe477e8de99a4eaa7.exe

  • Size

    25KB

  • MD5

    f80cfdeb3b16f7aba048db6cbaa2a878

  • SHA1

    241f6d3376a1dca95f1112928ea780c81b31d1dd

  • SHA256

    e56c5a819b8f3ae19fab76fa55d5838152930dcc74d60fbbe477e8de99a4eaa7

  • SHA512

    1ad3687d578649b58a6da1eeb5049a01afd8d92c96f5febe13ae376b8aabaf27a98d656f597ba62b2b9445b9c9fa90603f3c131d486e223aa1e055398a02df28

  • SSDEEP

    384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvn:8Q3LotOPNSQVwVVxGKEvKHrVn

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e56c5a819b8f3ae19fab76fa55d5838152930dcc74d60fbbe477e8de99a4eaa7.exe
    "C:\Users\Admin\AppData\Local\Temp\e56c5a819b8f3ae19fab76fa55d5838152930dcc74d60fbbe477e8de99a4eaa7.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\spoolsv.exe
      "C:\Windows\spoolsv.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:2916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GmXYg8zcEA01z0b.exe

    Filesize

    25KB

    MD5

    ccd5d17083156c3a54c9c68b8548b205

    SHA1

    43bb2537509232a211a11fa2120d90c484757f7f

    SHA256

    501fc57e8b7b170eee1357be565f9f0b8697b8c46d99969b939676e443b31e32

    SHA512

    e0e77876df4b15c06593cb780e6ed10af542a7b08f87a0eed22c8e2901297eb22a9efc86a436893b94db5b87a0cb3954b0a395a289d1dcbbecabe621fc43db68

  • C:\Users\Admin\AppData\Local\Temp\GmXYg8zcEA01z0b.exe

    Filesize

    25KB

    MD5

    ccd5d17083156c3a54c9c68b8548b205

    SHA1

    43bb2537509232a211a11fa2120d90c484757f7f

    SHA256

    501fc57e8b7b170eee1357be565f9f0b8697b8c46d99969b939676e443b31e32

    SHA512

    e0e77876df4b15c06593cb780e6ed10af542a7b08f87a0eed22c8e2901297eb22a9efc86a436893b94db5b87a0cb3954b0a395a289d1dcbbecabe621fc43db68

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb