Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 08:45
Static task
static1
Behavioral task
behavioral1
Sample
12de67671478b5e64f2f453eb861238e.exe
Resource
win7-20231129-en
General
-
Target
12de67671478b5e64f2f453eb861238e.exe
-
Size
250KB
-
MD5
12de67671478b5e64f2f453eb861238e
-
SHA1
ae772610e68b1a5ac05fc9eec1bebc93ae82ea9b
-
SHA256
5ca4396c17bed61237f10391412184039062e7e7f51e2f334a22eeaccb667f4d
-
SHA512
35fe593e56c8e7c55ed54707083315d81caf4dac214c5e61c3d5eb959950ef223d61b7c13e71ef34aaac03b4639bff18e6ceb46290a2e157928fc499140cb9c6
-
SSDEEP
6144:h1OgDPdkBAFZWjadD4s5kY1tvYTlERQDcisW:h1OgLdaOnQpWScVW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2924 50f90a5d3f513.exe -
Loads dropped DLL 5 IoCs
pid Process 848 12de67671478b5e64f2f453eb861238e.exe 2924 50f90a5d3f513.exe 2924 50f90a5d3f513.exe 2924 50f90a5d3f513.exe 2924 50f90a5d3f513.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2924-81-0x0000000075110000-0x000000007511A000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jegkjiamlnoppkbbchfagpfchjblclad\1\manifest.json 50f90a5d3f513.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A317E4DB-F73A-655A-3D2C-492ADB7D2272}\NoExplorer = "1" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A317E4DB-F73A-655A-3D2C-492ADB7D2272} 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A317E4DB-F73A-655A-3D2C-492ADB7D2272}\ = "SaveSale" 50f90a5d3f513.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x000600000001650c-30.dat nsis_installer_1 behavioral1/files/0x000600000001650c-30.dat nsis_installer_2 -
Modifies registry class 45 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{A317E4DB-F73A-655A-3D2C-492ADB7D2272}\ProgID 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A317E4DB-F73A-655A-3D2C-492ADB7D2272}\InProcServer32\ = "C:\\ProgramData\\SaveSale\\50f90a5d3f54c.dll" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{A317E4DB-F73A-655A-3D2C-492ADB7D2272}\InProcServer32 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\SaveSale\\50f90a5d3f54c.tlb" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\SaveSale" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A317E4DB-F73A-655A-3D2C-492ADB7D2272}\InProcServer32\ThreadingModel = "Apartment" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A317E4DB-F73A-655A-3D2C-492ADB7D2272}\ProgID\ = "SaveSale.1" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{A317E4DB-F73A-655A-3D2C-492ADB7D2272} 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 50f90a5d3f513.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A317E4DB-F73A-655A-3D2C-492ADB7D2272}\ = "SaveSale" 50f90a5d3f513.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 848 wrote to memory of 2924 848 12de67671478b5e64f2f453eb861238e.exe 16 PID 848 wrote to memory of 2924 848 12de67671478b5e64f2f453eb861238e.exe 16 PID 848 wrote to memory of 2924 848 12de67671478b5e64f2f453eb861238e.exe 16 PID 848 wrote to memory of 2924 848 12de67671478b5e64f2f453eb861238e.exe 16 PID 848 wrote to memory of 2924 848 12de67671478b5e64f2f453eb861238e.exe 16 PID 848 wrote to memory of 2924 848 12de67671478b5e64f2f453eb861238e.exe 16 PID 848 wrote to memory of 2924 848 12de67671478b5e64f2f453eb861238e.exe 16 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID 50f90a5d3f513.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A317E4DB-F73A-655A-3D2C-492ADB7D2272} = "1" 50f90a5d3f513.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12de67671478b5e64f2f453eb861238e.exe"C:\Users\Admin\AppData\Local\Temp\12de67671478b5e64f2f453eb861238e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\7zS17C5.tmp\50f90a5d3f513.exe.\50f90a5d3f513.exe /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Modifies registry class
- System policy modification
PID:2924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5b78633fae8aaf5f7e99e9c736f44f9c5
SHA126fc60e29c459891ac0909470ac6c61a1eca1544
SHA256d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
SHA5123885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43