Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
entry001/200220151240.jpg.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
entry001/200220151240.jpg.exe
Resource
win10v2004-20230915-en
General
-
Target
entry001/200220151240.jpg.exe
-
Size
2.4MB
-
MD5
9060edf6bf993434b2480476dda304f4
-
SHA1
a74f79de70629d3782c6e70a7be0202b9b0876bd
-
SHA256
b46e55a9d44bc36bcd0cd0a6cf51b42e3093f358fedd63d905d18bd2cb5d21b0
-
SHA512
1f6082d893db4f12d7af5de74d1725b4431dcc57947f55cae7186e38cb7da1e620e7407fc512778d648e86c7b251a8ed97030f7940a54e527539a45a5ab47303
-
SSDEEP
24576:b8h4aPlfTUYDrQOfseBC1+ZnoBzEgY5cfPtQE3WV9UKkjhmKiKSqSWLaPgIze7my:b1U9T8ZDYWntr3WVajW4I3VGihb7
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtalkupdate = "C:\\Users\\Admin\\gupd.exe" 200220151240.jpg.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1776 200220151240.jpg.exe -
Suspicious behavior: MapViewOfSection 22 IoCs
pid Process 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe 1776 200220151240.jpg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1776 200220151240.jpg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1776 wrote to memory of 372 1776 200220151240.jpg.exe 24 PID 1776 wrote to memory of 372 1776 200220151240.jpg.exe 24 PID 1776 wrote to memory of 372 1776 200220151240.jpg.exe 24 PID 1776 wrote to memory of 372 1776 200220151240.jpg.exe 24 PID 1776 wrote to memory of 372 1776 200220151240.jpg.exe 24 PID 1776 wrote to memory of 372 1776 200220151240.jpg.exe 24 PID 1776 wrote to memory of 372 1776 200220151240.jpg.exe 24 PID 1776 wrote to memory of 384 1776 200220151240.jpg.exe 23 PID 1776 wrote to memory of 384 1776 200220151240.jpg.exe 23 PID 1776 wrote to memory of 384 1776 200220151240.jpg.exe 23 PID 1776 wrote to memory of 384 1776 200220151240.jpg.exe 23 PID 1776 wrote to memory of 384 1776 200220151240.jpg.exe 23 PID 1776 wrote to memory of 384 1776 200220151240.jpg.exe 23 PID 1776 wrote to memory of 384 1776 200220151240.jpg.exe 23 PID 1776 wrote to memory of 420 1776 200220151240.jpg.exe 3 PID 1776 wrote to memory of 420 1776 200220151240.jpg.exe 3 PID 1776 wrote to memory of 420 1776 200220151240.jpg.exe 3 PID 1776 wrote to memory of 420 1776 200220151240.jpg.exe 3 PID 1776 wrote to memory of 420 1776 200220151240.jpg.exe 3 PID 1776 wrote to memory of 420 1776 200220151240.jpg.exe 3 PID 1776 wrote to memory of 420 1776 200220151240.jpg.exe 3 PID 1776 wrote to memory of 464 1776 200220151240.jpg.exe 2 PID 1776 wrote to memory of 464 1776 200220151240.jpg.exe 2 PID 1776 wrote to memory of 464 1776 200220151240.jpg.exe 2 PID 1776 wrote to memory of 464 1776 200220151240.jpg.exe 2 PID 1776 wrote to memory of 464 1776 200220151240.jpg.exe 2 PID 1776 wrote to memory of 464 1776 200220151240.jpg.exe 2 PID 1776 wrote to memory of 464 1776 200220151240.jpg.exe 2 PID 1776 wrote to memory of 480 1776 200220151240.jpg.exe 1 PID 1776 wrote to memory of 480 1776 200220151240.jpg.exe 1 PID 1776 wrote to memory of 480 1776 200220151240.jpg.exe 1 PID 1776 wrote to memory of 480 1776 200220151240.jpg.exe 1 PID 1776 wrote to memory of 480 1776 200220151240.jpg.exe 1 PID 1776 wrote to memory of 480 1776 200220151240.jpg.exe 1 PID 1776 wrote to memory of 480 1776 200220151240.jpg.exe 1 PID 1776 wrote to memory of 488 1776 200220151240.jpg.exe 22 PID 1776 wrote to memory of 488 1776 200220151240.jpg.exe 22 PID 1776 wrote to memory of 488 1776 200220151240.jpg.exe 22 PID 1776 wrote to memory of 488 1776 200220151240.jpg.exe 22 PID 1776 wrote to memory of 488 1776 200220151240.jpg.exe 22 PID 1776 wrote to memory of 488 1776 200220151240.jpg.exe 22 PID 1776 wrote to memory of 488 1776 200220151240.jpg.exe 22 PID 1776 wrote to memory of 604 1776 200220151240.jpg.exe 21 PID 1776 wrote to memory of 604 1776 200220151240.jpg.exe 21 PID 1776 wrote to memory of 604 1776 200220151240.jpg.exe 21 PID 1776 wrote to memory of 604 1776 200220151240.jpg.exe 21 PID 1776 wrote to memory of 604 1776 200220151240.jpg.exe 21 PID 1776 wrote to memory of 604 1776 200220151240.jpg.exe 21 PID 1776 wrote to memory of 604 1776 200220151240.jpg.exe 21 PID 1776 wrote to memory of 680 1776 200220151240.jpg.exe 4 PID 1776 wrote to memory of 680 1776 200220151240.jpg.exe 4 PID 1776 wrote to memory of 680 1776 200220151240.jpg.exe 4 PID 1776 wrote to memory of 680 1776 200220151240.jpg.exe 4 PID 1776 wrote to memory of 680 1776 200220151240.jpg.exe 4 PID 1776 wrote to memory of 680 1776 200220151240.jpg.exe 4 PID 1776 wrote to memory of 680 1776 200220151240.jpg.exe 4 PID 1776 wrote to memory of 756 1776 200220151240.jpg.exe 20 PID 1776 wrote to memory of 756 1776 200220151240.jpg.exe 20 PID 1776 wrote to memory of 756 1776 200220151240.jpg.exe 20 PID 1776 wrote to memory of 756 1776 200220151240.jpg.exe 20 PID 1776 wrote to memory of 756 1776 200220151240.jpg.exe 20 PID 1776 wrote to memory of 756 1776 200220151240.jpg.exe 20 PID 1776 wrote to memory of 756 1776 200220151240.jpg.exe 20 PID 1776 wrote to memory of 812 1776 200220151240.jpg.exe 19
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:680
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1112
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:2460
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1444
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1076
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:364
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=163⤵PID:384
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:280
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:964
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:848
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:812
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:756
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:604
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding3⤵PID:2152
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}3⤵PID:2736
-
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\entry001\200220151240.jpg.exe"C:\Users\Admin\AppData\Local\Temp\entry001\200220151240.jpg.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:488
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:372