Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 21:20
Behavioral task
behavioral1
Sample
3d3863207f7d96eb34d58a7c58841a00.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3d3863207f7d96eb34d58a7c58841a00.exe
Resource
win10v2004-20231215-en
General
-
Target
3d3863207f7d96eb34d58a7c58841a00.exe
-
Size
347KB
-
MD5
3d3863207f7d96eb34d58a7c58841a00
-
SHA1
2232e5a01b356051311b98320027bd429da1e164
-
SHA256
4e30d4996b1aa35c126453a777d5a0456457b375258f7077b2284bf042baf99e
-
SHA512
8286e968f2249fb817060f516a2b08124154d5af8704673b243b026801d84260895ad09a96bbbe9a75aa1b4b300b55102783e0cdcaf2c7d19602d2a2da8026e3
-
SSDEEP
6144:hGyGpETomEh+nAXutsj4OSQZhf5bHyIf6oQbsVwRq9id+1xpChMT:h3gET0P4OS4hfZ5fL7VCqNY0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2300 AfFtNiJAk5skZ1E.exe 2668 CTS.exe -
Loads dropped DLL 2 IoCs
pid Process 828 3d3863207f7d96eb34d58a7c58841a00.exe 828 3d3863207f7d96eb34d58a7c58841a00.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/828-0-0x0000000000DC0000-0x0000000000DD7000-memory.dmp upx behavioral1/files/0x000b000000015c1b-13.dat upx behavioral1/memory/2668-18-0x0000000000F30000-0x0000000000F47000-memory.dmp upx behavioral1/memory/828-14-0x0000000000DC0000-0x0000000000DD7000-memory.dmp upx behavioral1/memory/828-9-0x0000000000080000-0x0000000000097000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 3d3863207f7d96eb34d58a7c58841a00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 3d3863207f7d96eb34d58a7c58841a00.exe File created C:\Windows\CTS.exe CTS.exe -
Modifies registry class 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell\open\command AfFtNiJAk5skZ1E.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell AfFtNiJAk5skZ1E.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell\open AfFtNiJAk5skZ1E.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AFFTNI~1.EXE \"%1\"" AfFtNiJAk5skZ1E.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.GRF AfFtNiJAk5skZ1E.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.GRF\ = "GraphEdtGraph" AfFtNiJAk5skZ1E.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph AfFtNiJAk5skZ1E.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GraphEdtGraph\ = "Filter Graph" AfFtNiJAk5skZ1E.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 828 3d3863207f7d96eb34d58a7c58841a00.exe Token: SeDebugPrivilege 2668 CTS.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2300 AfFtNiJAk5skZ1E.exe 2300 AfFtNiJAk5skZ1E.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 828 wrote to memory of 2300 828 3d3863207f7d96eb34d58a7c58841a00.exe 28 PID 828 wrote to memory of 2300 828 3d3863207f7d96eb34d58a7c58841a00.exe 28 PID 828 wrote to memory of 2300 828 3d3863207f7d96eb34d58a7c58841a00.exe 28 PID 828 wrote to memory of 2300 828 3d3863207f7d96eb34d58a7c58841a00.exe 28 PID 828 wrote to memory of 2668 828 3d3863207f7d96eb34d58a7c58841a00.exe 29 PID 828 wrote to memory of 2668 828 3d3863207f7d96eb34d58a7c58841a00.exe 29 PID 828 wrote to memory of 2668 828 3d3863207f7d96eb34d58a7c58841a00.exe 29 PID 828 wrote to memory of 2668 828 3d3863207f7d96eb34d58a7c58841a00.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d3863207f7d96eb34d58a7c58841a00.exe"C:\Users\Admin\AppData\Local\Temp\3d3863207f7d96eb34d58a7c58841a00.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\AfFtNiJAk5skZ1E.exeC:\Users\Admin\AppData\Local\Temp\AfFtNiJAk5skZ1E.exe2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2300
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD55efd390d5f95c8191f5ac33c4db4b143
SHA142d81b118815361daa3007f1a40f1576e9a9e0bc
SHA2566028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74
SHA512720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d
-
Filesize
288KB
MD5880e155f8f47fb0db7b2080e71d59568
SHA12ed0c0f809765bbabd8c7d4f58e9a0bacf2bb629
SHA2566011cd7d1a314d109bc0755d17be2e7812b2f5542ec24f3f3023532c1e8a1d44
SHA51270977d36b8ec8c271c5ffd3303677743a2626196bb62af5d817e86a7eeed972bbb70acdd81508f7b4ee1da366ce02cd96a8d0e6f11627842f195cfd0c53a5bec