Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 23:18

General

  • Target

    0df43a35a0e6dc9bdc0466d2fb3d92471fa1fc6a1e49d0dcc47968285885dc59.exe

  • Size

    25KB

  • MD5

    158750a4c540b4eda60ed5a0a3a80491

  • SHA1

    0891964d162f1942d562e76d0c723b54b679bec1

  • SHA256

    0df43a35a0e6dc9bdc0466d2fb3d92471fa1fc6a1e49d0dcc47968285885dc59

  • SHA512

    05603b9ecbd0a1f892d4c5b3d1353c3dd1cbcf837b0cd4c8ab2a3a3f52e6b056e059670c9c3c506c4caaf0daca9ae5f6964178c99cff8654e195c36466d200b1

  • SSDEEP

    384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjvBQ:8Q3LotOPNSQVwVVxGKEvKHrVC

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0df43a35a0e6dc9bdc0466d2fb3d92471fa1fc6a1e49d0dcc47968285885dc59.exe
    "C:\Users\Admin\AppData\Local\Temp\0df43a35a0e6dc9bdc0466d2fb3d92471fa1fc6a1e49d0dcc47968285885dc59.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2436
    • C:\Windows\spoolsv.exe
      "C:\Windows\spoolsv.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:2440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\zNYgTcBaMtdRt0Q.exe

    Filesize

    25KB

    MD5

    e88c55e7416579d2269ef39df160603b

    SHA1

    3d721f21e8b6c1ffc3ae78a374581b9b9509866e

    SHA256

    d6666fbca1db62475a48bbcfc51e9740ea422714d6f7768742da3e931fa724c1

    SHA512

    dea59acd7d91179cd1c9e7edd9149b9757e9bb126ffe44cf2a9fc42f90725c93a73869b84b3ea5c8b6dd050dcaf8fff9f7738b3afa4d44481d22f9767bc52ad0

  • C:\Users\Admin\AppData\Local\Temp\zNYgTcBaMtdRt0Q.exe

    Filesize

    25KB

    MD5

    e88c55e7416579d2269ef39df160603b

    SHA1

    3d721f21e8b6c1ffc3ae78a374581b9b9509866e

    SHA256

    d6666fbca1db62475a48bbcfc51e9740ea422714d6f7768742da3e931fa724c1

    SHA512

    dea59acd7d91179cd1c9e7edd9149b9757e9bb126ffe44cf2a9fc42f90725c93a73869b84b3ea5c8b6dd050dcaf8fff9f7738b3afa4d44481d22f9767bc52ad0

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb