Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 18:44

General

  • Target

    99c0bc283e7897d00cbae06b49acd26d_JC.exe

  • Size

    82KB

  • MD5

    99c0bc283e7897d00cbae06b49acd26d

  • SHA1

    c26f1b49721f3676747db58b0519735598153193

  • SHA256

    fee0f29686b7164dacc3bbfe9c5e2bdac24d37f0e617721788eec173c976ba0c

  • SHA512

    e41ec592ac9944c42c9f93b7dc43b4baa1d90ab401567a6436d28e8fe795285ff592ae57284ea87e918b0a100befd468d1a88076242b80fa6952931983ba174e

  • SSDEEP

    768:NNK2cNW0QbRsWjcd+6yBFLqJ4Z8qx70RM8/O/B2ZR1RGn8NIoGLLRNeo6:NcNjQlsWjcd+xzl7SM+Gn8255Neo6

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99c0bc283e7897d00cbae06b49acd26d_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\99c0bc283e7897d00cbae06b49acd26d_JC.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\LrKLKbrQnmTgEoY.exe

    Filesize

    82KB

    MD5

    2012cbd972fa6c9950e96a1ebf011e97

    SHA1

    99a45fdfe974536cc293c52fb2f8286d5ca22976

    SHA256

    f502db6b1b5c361550d6a6bbbc48b37207558aead6fa080fbd56e691c091031b

    SHA512

    f510a309e9355798adc320f42e566f5f604bcaa02f9ea698588ee3c9f86347cfc78845c698ab2e6afcc363f8f0d4fa1e10cd3581a61d5ddcced88abcad52b1a8

  • C:\Windows\CTS.exe

    Filesize

    82KB

    MD5

    112e2e3d0f9b5bdfc715836bfd6360cf

    SHA1

    3376a739daff15255ad9b6552897856df1778ed1

    SHA256

    739998c19476d853c1c4264b79f01c4c3429c8e34746a6e22fdb7ef07db375db

    SHA512

    6ec42ffda1f8c8245ece5856b6536c3dc9e6ff78bc93ab1a123ee6b01dadd2550ffa8623bd2e21038e27f2a94b305dba02f9abd31576c62d9f3ed90c98974f4b

  • C:\Windows\CTS.exe

    Filesize

    82KB

    MD5

    112e2e3d0f9b5bdfc715836bfd6360cf

    SHA1

    3376a739daff15255ad9b6552897856df1778ed1

    SHA256

    739998c19476d853c1c4264b79f01c4c3429c8e34746a6e22fdb7ef07db375db

    SHA512

    6ec42ffda1f8c8245ece5856b6536c3dc9e6ff78bc93ab1a123ee6b01dadd2550ffa8623bd2e21038e27f2a94b305dba02f9abd31576c62d9f3ed90c98974f4b

  • C:\Windows\CTS.exe

    Filesize

    82KB

    MD5

    112e2e3d0f9b5bdfc715836bfd6360cf

    SHA1

    3376a739daff15255ad9b6552897856df1778ed1

    SHA256

    739998c19476d853c1c4264b79f01c4c3429c8e34746a6e22fdb7ef07db375db

    SHA512

    6ec42ffda1f8c8245ece5856b6536c3dc9e6ff78bc93ab1a123ee6b01dadd2550ffa8623bd2e21038e27f2a94b305dba02f9abd31576c62d9f3ed90c98974f4b

  • memory/1376-0-0x0000000000C40000-0x0000000000C59000-memory.dmp

    Filesize

    100KB

  • memory/1376-5-0x00000000000E0000-0x00000000000F9000-memory.dmp

    Filesize

    100KB

  • memory/1376-9-0x0000000000C40000-0x0000000000C59000-memory.dmp

    Filesize

    100KB

  • memory/2692-12-0x0000000000350000-0x0000000000369000-memory.dmp

    Filesize

    100KB