Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2023, 12:34

General

  • Target

    63b03fe163219157f841478f39ffbe45b4abcf1e6b9069753a2e75779d3714e3_JC.exe

  • Size

    396KB

  • MD5

    8efcc58e8465df3114695f8b7a5cc500

  • SHA1

    fb0ca2377e3d39fdf0248544289bd0f90ddcf394

  • SHA256

    63b03fe163219157f841478f39ffbe45b4abcf1e6b9069753a2e75779d3714e3

  • SHA512

    2a5cb881739926a62062514fb9353aaee0a280828486a45420cf62e472a98f32009dcb8499b5f4fb9f7f261b22f6fe7248a3cb22de4e640fe0168bb37173c4c5

  • SSDEEP

    12288:FFz/C7YvM4UGKMjBtfUUem58z8gO03DF:FFz/6YvTUj8ts458z8gOI

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63b03fe163219157f841478f39ffbe45b4abcf1e6b9069753a2e75779d3714e3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\63b03fe163219157f841478f39ffbe45b4abcf1e6b9069753a2e75779d3714e3_JC.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4152
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:220
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3724

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3724-55-0x000002173D160000-0x000002173D170000-memory.dmp

      Filesize

      64KB

    • memory/3724-75-0x0000021745610000-0x0000021745611000-memory.dmp

      Filesize

      4KB

    • memory/3724-74-0x0000021745500000-0x0000021745501000-memory.dmp

      Filesize

      4KB

    • memory/3724-73-0x0000021745500000-0x0000021745501000-memory.dmp

      Filesize

      4KB

    • memory/3724-71-0x00000217454D0000-0x00000217454D1000-memory.dmp

      Filesize

      4KB

    • memory/4152-16-0x0000000008190000-0x00000000081DC000-memory.dmp

      Filesize

      304KB

    • memory/4152-20-0x0000000000400000-0x0000000000470000-memory.dmp

      Filesize

      448KB

    • memory/4152-7-0x0000000004D40000-0x00000000052E4000-memory.dmp

      Filesize

      5.6MB

    • memory/4152-8-0x0000000004C40000-0x0000000004CA2000-memory.dmp

      Filesize

      392KB

    • memory/4152-9-0x0000000007770000-0x0000000007802000-memory.dmp

      Filesize

      584KB

    • memory/4152-10-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4152-11-0x0000000007900000-0x000000000790A000-memory.dmp

      Filesize

      40KB

    • memory/4152-12-0x0000000007940000-0x0000000007F58000-memory.dmp

      Filesize

      6.1MB

    • memory/4152-13-0x0000000007FE0000-0x0000000007FF2000-memory.dmp

      Filesize

      72KB

    • memory/4152-14-0x0000000008000000-0x000000000810A000-memory.dmp

      Filesize

      1.0MB

    • memory/4152-15-0x0000000008110000-0x000000000814C000-memory.dmp

      Filesize

      240KB

    • memory/4152-0-0x00000000006D0000-0x000000000070B000-memory.dmp

      Filesize

      236KB

    • memory/4152-17-0x00000000006D0000-0x000000000070B000-memory.dmp

      Filesize

      236KB

    • memory/4152-18-0x0000000008330000-0x0000000008396000-memory.dmp

      Filesize

      408KB

    • memory/4152-19-0x00000000020F0000-0x0000000002140000-memory.dmp

      Filesize

      320KB

    • memory/4152-6-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4152-21-0x00000000746D0000-0x0000000074E80000-memory.dmp

      Filesize

      7.7MB

    • memory/4152-22-0x0000000008AC0000-0x0000000008B36000-memory.dmp

      Filesize

      472KB

    • memory/4152-23-0x0000000008BA0000-0x0000000008BBE000-memory.dmp

      Filesize

      120KB

    • memory/4152-24-0x0000000008C70000-0x0000000008E32000-memory.dmp

      Filesize

      1.8MB

    • memory/4152-25-0x0000000008E40000-0x000000000936C000-memory.dmp

      Filesize

      5.2MB

    • memory/4152-26-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4152-28-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4152-29-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4152-30-0x0000000000400000-0x0000000000470000-memory.dmp

      Filesize

      448KB

    • memory/4152-5-0x0000000002430000-0x0000000002496000-memory.dmp

      Filesize

      408KB

    • memory/4152-4-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4152-3-0x00000000746D0000-0x0000000074E80000-memory.dmp

      Filesize

      7.7MB

    • memory/4152-2-0x0000000000400000-0x0000000000470000-memory.dmp

      Filesize

      448KB

    • memory/4152-1-0x00000000020F0000-0x0000000002140000-memory.dmp

      Filesize

      320KB