Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 21:08

General

  • Target

    3f9e3c847f2d46ab4126f6c8494ccab0bbeb85f57abd5fdab04cba3528ec6318.exe

  • Size

    26KB

  • MD5

    dc4ec0fec1b09b008d3329ba211bbf99

  • SHA1

    3d042f9b221e22c221a3cd478096d5b34c563fee

  • SHA256

    3f9e3c847f2d46ab4126f6c8494ccab0bbeb85f57abd5fdab04cba3528ec6318

  • SHA512

    70c149e29f777e87342381263f7c1dc32e779329b57581192700fe04d88137159f93c34d829afc1b31f09ae482aa94b1d17c3737f454e8d6784b4661e59d1b2a

  • SSDEEP

    384:qc0J+vqBoLotA8oPNIrxKRQSv7QrzVVvOytGxboE9K/mKHrjpjv0Kg:8Q3LotOPNSQVwVVxGKEvKHrV0Kg

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f9e3c847f2d46ab4126f6c8494ccab0bbeb85f57abd5fdab04cba3528ec6318.exe
    "C:\Users\Admin\AppData\Local\Temp\3f9e3c847f2d46ab4126f6c8494ccab0bbeb85f57abd5fdab04cba3528ec6318.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2112
    • C:\Windows\spoolsv.exe
      "C:\Windows\spoolsv.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      PID:1708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DRM7mY9ArFvNgjW.exe

    Filesize

    26KB

    MD5

    877cea9e56069b3f336211c725f0114d

    SHA1

    86dc4a910d729def5d390a08974283d54aef75f9

    SHA256

    b874e33cf64afde90801b95bd54ea1563a3b79c271fa15862c477721e2fd6c15

    SHA512

    274f1215081aa63ed17c4d4273bb4801abd2dfe72957efc50e2468bf61d631a6e303acc99c6193ece481371ddd87560c8b3e3e745787ff7052c6815655abf071

  • C:\Users\Admin\AppData\Local\Temp\DRM7mY9ArFvNgjW.exe

    Filesize

    26KB

    MD5

    877cea9e56069b3f336211c725f0114d

    SHA1

    86dc4a910d729def5d390a08974283d54aef75f9

    SHA256

    b874e33cf64afde90801b95bd54ea1563a3b79c271fa15862c477721e2fd6c15

    SHA512

    274f1215081aa63ed17c4d4273bb4801abd2dfe72957efc50e2468bf61d631a6e303acc99c6193ece481371ddd87560c8b3e3e745787ff7052c6815655abf071

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb

  • C:\Windows\spoolsv.exe

    Filesize

    25KB

    MD5

    82071fd2379c64429acf376487fcddff

    SHA1

    2da42c7eaa62ecee65757b441c939f12b52228fb

    SHA256

    272bd07fa6c2678fd96a026237a184fceffa65d319f6844bac582aff90ce25d8

    SHA512

    194bdbdf624ec425a095a44116032687c46b3e2370f3c436e2d5516dcc778824ff57fa69edfacb42e5e76e05894eb0a40acf32dcee3b80ba397f823ec82b6adb