Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 16:41

General

  • Target

    064cbd89d5bd9d2e43e32f0bbb92a418.exe

  • Size

    29KB

  • MD5

    064cbd89d5bd9d2e43e32f0bbb92a418

  • SHA1

    9b3b49cb1d8c6bfdced9c2b814cb4de0b9ebe30b

  • SHA256

    964be34b5f48f7542b4dca090fb43dad6e4cecaec169924368ded2a0cf48b5a2

  • SHA512

    1b870b67287e5188485acda180d8dd96c107190cc5e5210407b6afc3697d1d8d97022f7583089773a8fd5ed27dd7d963f589a3429c0f78b2afbbe7bc2acc8ab6

  • SSDEEP

    768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFk:SKcR4mjD9r823Fk

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\064cbd89d5bd9d2e43e32f0bbb92a418.exe
    "C:\Users\Admin\AppData\Local\Temp\064cbd89d5bd9d2e43e32f0bbb92a418.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    290KB

    MD5

    ba68ef2caba5b67befbdd34b98541018

    SHA1

    1746a8f1c39096a776bf124ad4151897c37ec4d5

    SHA256

    6371c46e427506664b01f7e32b085cfc343edd26964c3721f89f425f2188212c

    SHA512

    daa761af16cace4b24325d6c56101b0751e3c21e4442c13bdad84fcd1b13475f532de27ce506f20526601837275f603f81b7503fdc8b40f5d600d3a934b307ac

  • C:\Users\Admin\AppData\Local\Temp\Twfd84RVSBdMbXa.exe

    Filesize

    29KB

    MD5

    65d5d837a8cafdd712e487ea8c47141b

    SHA1

    f144582e330f22f05f6bffb20271be94d329942e

    SHA256

    2c804a5f48c2638b1725e84eb252537c480e8f1166366a08b753d3893c7183d8

    SHA512

    65623b019b09586a03eab7a7f54525e1e13dabbe13b28a6f25e179beda5bb0e8ff35e9201f44996f599701fe8ddb4640721f9f5db24154007709575417d4b6b2

  • C:\Windows\CTS.exe

    Filesize

    29KB

    MD5

    70aa23c9229741a9b52e5ce388a883ac

    SHA1

    b42683e21e13de3f71db26635954d992ebe7119e

    SHA256

    9d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2

    SHA512

    be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5

  • memory/1352-9-0x0000000000950000-0x0000000000967000-memory.dmp

    Filesize

    92KB

  • memory/4540-0-0x0000000000CA0000-0x0000000000CB7000-memory.dmp

    Filesize

    92KB

  • memory/4540-7-0x0000000000CA0000-0x0000000000CB7000-memory.dmp

    Filesize

    92KB