Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/12/2023, 10:33

General

  • Target

    07ef641c3737f3f129ef08ef7bf400af.exe

  • Size

    2.7MB

  • MD5

    07ef641c3737f3f129ef08ef7bf400af

  • SHA1

    81567ef4b8336942336c81cc0aa7d2a658a8bbde

  • SHA256

    c21d37fa74805b3abcb43e737a42f6f5da51c35c13cacd21c9b4431fbdd6fc54

  • SHA512

    116561bb62f3e196e11f1c6f083ef09afbad080299d6157459d537184e0e3946cb53a7c57514ed77cfbc91ca16b3d481f4894ad885ee2a3373f6ee3bbf50863b

  • SSDEEP

    49152:U7j7jfYV9zOe4gqmvwa3bBNSlGnPwPszW2Z4eiIijdtpU/eKXMZm3yf2dl:U33S9yfba33fqbGImCf2dl

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07ef641c3737f3f129ef08ef7bf400af.exe
    "C:\Users\Admin\AppData\Local\Temp\07ef641c3737f3f129ef08ef7bf400af.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Program Files\Internet Explorer\IEXPLORE.exe
      "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe

    Filesize

    2.9MB

    MD5

    c620b4e3d8df6e2ecba4647ce4ffd812

    SHA1

    1929a663dafc4adad4374a8bfbe00e199d6c555e

    SHA256

    4920be0972d56ee4938d9ed1a8a29f6898532fa54f00c209b0856657f653f8dc

    SHA512

    cee0f290e2861d3e5702a7e37ed697af40b7090e75bb05b60b7163edfaa9cbfce743405dd8c2ce0bbf0f3a4f825b4e155ac1c0383d12e8f1afb5d3ede5213b49

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    beab39407be1ce5b3017db255c2951b8

    SHA1

    929d2cecd739ee9e276517137f5cecf66bb0afc1

    SHA256

    431ba684d344443f9dc523e7a05b63c775307fd38ff4d0ebfcba213a41894950

    SHA512

    63c7c3b7470aaa993985d059992523ce332c4b88d9bd71c5aab05b626555859325dd364a3c08190129f785868d7b9ce10aaf6ab53e2ea57397518d868259d2b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a9b9fc71633b268abcc3749833f62994

    SHA1

    4c440c48a97d38fd91e17afcbf3314ac533fb0ad

    SHA256

    eb4e0eb5898b8684014f5385235ea4e23efeef9f4f7ba283f3238dd120c328cd

    SHA512

    75edbb1c4d995769919d2533f8aa255b140123ade4a7131adc7d6b3a90cdbffa71b228916dacd26f10a719cd2132c737d3c73218aaa7ee3ae155974807dde166

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    558a7831531d191823e256043de4a95f

    SHA1

    f5f2cc41dffdc7e3a70aa10d9d4735508af4ec74

    SHA256

    7aabd18fca27ba6b43bdc0f7142dcbc0c9b13cea3aaf9a609c757c8d0f48accd

    SHA512

    8d04604d7f52304d03ac42247a9ae39fdbfe4483cf2df084c0d090c60af7a7f7ae0306b930c705a32fcd2d5ee9e64ced10ffbd833b2b15824be20c9c18e21242

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    24845680dbc81e9b3827c9e95da3ba0c

    SHA1

    8bccfe5b60dca847db37d8ce55e6dd5eb2675263

    SHA256

    3e4be90507aee40be2f1a663f1d4ab07d7a03b98040ae406c718dd9a028cc8bc

    SHA512

    f14a466e3bf93151b209e354c26f42064509e9244759c4f169f1948c603143cc6898de2a0068d4cdcdcc45645a026fcdf0ff431fab726f8ba12b2997b705a356

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    662d62244653cb593e89323fd7465f57

    SHA1

    db9c61206d6baf2b2625eb544f63c220fc609187

    SHA256

    47eb54d53a022ca4f0e2e49bd51c0efc30e8596a055bb41a55971d87b5de2e67

    SHA512

    fc13a45f996775bee259c6cdbe10947cb2fa3ff2f833395533a801c3170d225c398a411a301bd515216f3515a1ebd5d61896dbd2a6a5b7418f902a5e159febde

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    433008dfde10387f171ece5f68e39fad

    SHA1

    dcbf6abcab735fe29582f0350a892d1a9d5d9d1b

    SHA256

    d5956548f4a963ee3c9d1683f5ba35d384011927201009582889e7f3976b8edd

    SHA512

    62274d6d5343ee68d328f739b95db99de840acccc59fcd296d0d46c354e504b8b297ee3310a19c3843c4bc7035aac932ec2a07b28750cf6468c2791cd8909c14

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4b6c16a5e37d8bf16d31560889129287

    SHA1

    fb2f4aa96aac2b8d54bf1c51b8bd4106ad48ed42

    SHA256

    46a9d36deee28bc2033cca4c72f2ea418339aabd87c1d7b2346863d6feab7473

    SHA512

    1a4aaa82b09ce7f12279b0af371084c625c24256e0d789465583119cb7e47d9b52ea462661f61bd8c8fdb5fc0beb91d856533dc8ec0826b588b1fd50f01c7d4c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b92757d31bedda55e7a5fc3f62eddd5c

    SHA1

    e78984fa9ff7f88372ac11e4a9594212492e9e9f

    SHA256

    bd4e095f1e5d1235b2d577ca413ef41abe5b5895124e530f5d84c76e39a1f4cf

    SHA512

    6918de65ab57e0c625a9097ee7b19775db0b5c51c10c421acb0c8c7b79666ea4b7c784f3084b5a330cd91c5a8f686e3fedb61657a37d792503c5c51fb2337536

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    48fcc7742eea8f3537192f6a1799623a

    SHA1

    a7bc8a30b691fe67327bf653116a16ce3ea89f09

    SHA256

    63c0879391f781bc81cc3d466080822bbc4f778c794b4ea8e5f50e6fdff3b44e

    SHA512

    87f3cab6b535fef8188fbb53ef633c9a8ab3ec3ffec1438edace0c7e9216e4999473ffda443b625b92a2e5b1b8a00b8244288bd9be1c34a9af451843b1a89788

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    31503dee9b45269a2b86e8445d5fa781

    SHA1

    5940f51be482645119f5a4e7e6e28db67609c76b

    SHA256

    e3e1cce571bbf7b3e5a4848ddb4a7889e52c393121638c2c40d3d0a2c3ae782c

    SHA512

    2febdb03a69ce9f62e0a2a723aa3b2c93873348de7b99989174ee93b40a5e9a81d0f945edc51f0dcb0c9f6dd60a2a6c16f526e1264b0e456b87f068ad8632330

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    490a60b98eadeb2baaf2accd21ab4440

    SHA1

    d600b9785f9c29cdfcbb5d3ceab92325767d303c

    SHA256

    90e4acced66f71d7cbfd2f39154d481c7e62ba8bf364b72bf5d7c95cd0e0e95d

    SHA512

    8950fb9739ac5ec6f696a002769e114dbb3d2baf929bd8524c4d18dcb5828baa35c8215ae459dfc8c6774298b7a7ec8bf18907149bc4acf7ef34d800a2d91b94

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ffec19395b179bba16651d89112872f6

    SHA1

    fed179d1d9d25753f705796130589eb92371a727

    SHA256

    4e9953c0494093801c9fe6f1f3e554d8f6f72405a3c53365eb4b604adab7ed9f

    SHA512

    4ea59fbddec2e24e62ee282b835422db4ed94ac630470b6f6ab15b1be16d330f2feae46841f466534e06b5c57ee1462a3396a097da4b2a47dab20e381eb9cb03

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a0255cbd3581c1015827f5fec89df446

    SHA1

    ce3cd9749fd31ca3a824a2a6e3ab997b11ade2a4

    SHA256

    fe83b8eb602d270d534cdfb72aa3b823b3bb927135328457487ee7c0f8ff0704

    SHA512

    e697a5a3b9a126cc2295f780d78085d6228135be7a9dc585e8c599e92e685596a20d91ce1fe31953249e55bdad6c3c16c885ec2bb0fa0c754b7c93a1653858c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b65c0f5d082948c696e55ba2e5312541

    SHA1

    56287d294d307f149d82561a5d9aef7cde9e73cd

    SHA256

    b7f88b4842d8067eb2881f9eae8f0ed082416e859a44d64075395e7001708c5f

    SHA512

    bb5e76bbfdf3e1a1b01997860672d9e173d74c5eb461759aecbc26a71db14fdab6639af62ade92f79bae293fdde2bd68fffd7769cb7a11eae98585adc99df91c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6517342855f9c618b52f99265bb5f2a2

    SHA1

    2df17c7d007703f043c13f336ccf34c230c899a8

    SHA256

    57865789f5b2fa2075c17f40d3d1b3593396396816ec2392c18654b5e705373e

    SHA512

    684479751e40662683108f21f9098d07e5e2584ff2095c1b9dbfc0cd75c26cfba7da39dbe1b847db88ff15f8c78e7b2a7abe89fb49bde4956d7c96cde90c0139

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c15ddd3126641dfa49bbc95fa52f70cb

    SHA1

    f4837d809c5385b8f0d2567099941f9de3530615

    SHA256

    b66d2e34881e55deabd7f96477865fa774d26b6f76432ef7ab1344360740f4a1

    SHA512

    36248da5c58c900a589c301e4a188016640730719b5a13bb8ff9483559ea113071669d9e7e115d80e2460b5fd304a054134120ba8457d7c0b94d07bf9ec8da5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    28cba9bd2b4c4028150e1c5d06e8d8c5

    SHA1

    115a9de3c55d877dc0aa5a3e6c6433f6ced702ea

    SHA256

    c32d9d8626f4b26be132957262b03764e3baba65d5132e0cae1afbe4fa99f868

    SHA512

    8f37231ded2f275a5965fd555488637e79d4972c4c48d272cb2debfe2fc498277be3f9f771045f3d2ca8a50df4968b442175a566de81765f35dbefbd64f0011a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    553c93c10eca659c1a7c5bee805d8be0

    SHA1

    4fdadf0c406a4cd5bde3991413bf4bba712f7865

    SHA256

    32894430d6d864bf86d215247d540c3d0e5ae966108a7e904b121f61fcee0949

    SHA512

    50466af61103d480bc097a00c0c4f95ace4f117929726f238023a85bd73d37e00ba7ae2747c0a188f49ca1cf85450affa230682f16aeb2fc7251a0e6fd8d5f51

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6575a5d4bc6281c350f342ae95b6e42a

    SHA1

    f7399a04b067ffd85b149adf274bf0a3fbef9637

    SHA256

    17657fd1ffbd273898de1c020e5d7787fc401bd70dbf3f90ad3edd068352b9f5

    SHA512

    768e573541c20fd114770905b015c4df8d091168d03a2bb8061bb0763d15b1050ab13a80887bf849bcfbf44b125d810f08d7d017328451e11a544ad8683b32ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d7fd4a741baa4912bdd4e1cc833af2f6

    SHA1

    ee3ffa519ca051c639050a8a314d21d5357945e8

    SHA256

    8f80d70c831b1d5cd79dcd0ce311e2090b794480457b53052bd2cc5f9479153f

    SHA512

    45982da122d0ef6c2d9e3533bdc6e149836ee7ca18901184386497f5aa6f088daf867dbd3116c16f7b4135d2937b5b1e57ab3b531b487d71f7aa3b3d57cbd887

  • C:\Users\Admin\AppData\Local\Temp\Cab5C73.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar6187.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/1200-1674-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1200-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB