Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23/11/2023, 03:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
Resource
win7-20231020-en
windows7-x64
6 signatures
150 seconds
General
-
Target
667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe
-
Size
5.9MB
-
MD5
249242a52c6de7580faf8ae9eed16e40
-
SHA1
635914243c2ebc9e1c5747e37b52dd937c347437
-
SHA256
667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec
-
SHA512
4ba1e57469f9a8d64f254d6375dc0f79510fe15cf5635a668e36646ed26ee59c99bf381a2fc10135e9ba4d886bf51e23215dda6fecb98b1cdd57a729429cde8e
-
SSDEEP
49152:LPdN+rb/TAvO90dL3BmAFd4A64nsfJvrysOEm7FLRDLDeyIPsE9nS3QVxMdaQSes:zicfXDMbsHbxtEnBZ91I
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1404 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4584 ipconfig.exe 2404 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe Token: SeDebugPrivilege 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe Token: SeDebugPrivilege 1404 tasklist.exe Token: SeDebugPrivilege 2404 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3528 wrote to memory of 4752 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 83 PID 3528 wrote to memory of 4752 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 83 PID 3528 wrote to memory of 1960 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 85 PID 3528 wrote to memory of 1960 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 85 PID 3528 wrote to memory of 2080 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 88 PID 3528 wrote to memory of 2080 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 88 PID 3528 wrote to memory of 2384 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 87 PID 3528 wrote to memory of 2384 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 87 PID 4752 wrote to memory of 4584 4752 cmd.exe 91 PID 4752 wrote to memory of 4584 4752 cmd.exe 91 PID 3528 wrote to memory of 1120 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 92 PID 3528 wrote to memory of 1120 3528 667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe 92 PID 1960 wrote to memory of 1404 1960 cmd.exe 94 PID 1960 wrote to memory of 1404 1960 cmd.exe 94 PID 2080 wrote to memory of 2932 2080 cmd.exe 95 PID 2080 wrote to memory of 2932 2080 cmd.exe 95 PID 2384 wrote to memory of 2152 2384 cmd.exe 96 PID 2384 wrote to memory of 2152 2384 cmd.exe 96 PID 1120 wrote to memory of 2404 1120 cmd.exe 98 PID 1120 wrote to memory of 2404 1120 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe"C:\Users\Admin\AppData\Local\Temp\667f82cb12b50a835e8a0e3d16113ade42cf89df2426427d24b1a3cc474897ec.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\system32\cmd.execmd.exe /c "ipconfig /all"2⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4584
-
-
-
C:\Windows\system32\cmd.execmd.exe /c tasklist2⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "arp -a"2⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\system32\ARP.EXEarp -a3⤵PID:2152
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "netsh wlan show profiles"2⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵PID:2932
-
-
-
C:\Windows\system32\cmd.execmd.exe /c "netstat -ano -p TCP"2⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\system32\NETSTAT.EXEnetstat -ano -p TCP3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-