Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 00:46

General

  • Target

    4757e9236e993b81c6d155f65a02e77c.exe

  • Size

    250KB

  • MD5

    4757e9236e993b81c6d155f65a02e77c

  • SHA1

    fb7a76063c0d549e91cd72e17d1c020960e990ab

  • SHA256

    47ab3ea7cb94e084df4ffb4982c9fc5065b1715abde329324837956c62ce51d5

  • SHA512

    8c6da637c6d30ee9edb0dcf4a5f7e02de233dbf95f2fd53e4656d0b4291538883cd5ea1f3da23f80816d4b6110453e78c63ddd040690adc9aa3d2170d594fe59

  • SSDEEP

    6144:h1OgDPdkBAFZWjadD4s5p5cCZLh2UDV3fWDQWHbMD:h1OgLdaOp5PvDtfWfQD

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
  • Modifies registry class 45 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4757e9236e993b81c6d155f65a02e77c.exe
    "C:\Users\Admin\AppData\Local\Temp\4757e9236e993b81c6d155f65a02e77c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\51035b77a3f96.exe
      .\51035b77a3f96.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Download and Sa\uninstall.exe

    Filesize

    48KB

    MD5

    f3c79bda3fdf7c5dd24d60400a57cadb

    SHA1

    1adb606aaeedb246a371c8877c737f0f8c798625

    SHA256

    a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

    SHA512

    c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    657b19ac59c1bfe1d9e1d9042ecf1335

    SHA1

    cf1e5eae0a71bce6d39c4355530d448155fefd37

    SHA256

    da1e4df5ac2342c6e5efadb3e69221c9b9efb4905e9a2512e19bd79494e99518

    SHA512

    d6f6a2507db7ac67da8a5fae2d3255b64494fd5f3a3b83324653f587dba7dd7112ecd6ba98f1716fd1d541baf9975edabb350a84c3b6fcde7bd183110eb623c7

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\[email protected]\chrome.manifest

    Filesize

    116B

    MD5

    2b0a07c7bccbdafcfbd993c077914ec9

    SHA1

    ea3acd38d8271ef951c622ae5715756dde9e1d0b

    SHA256

    845ed2a0d35cb0268549f0671edd92f55b2dc26bfc01e76161240444eeabbc39

    SHA512

    9e6874deddb15bc3e54e89c778a67579aca74e8dbb3b2da001219f05cd22e59782cbeefd55c34ab2314b7cca27c4727306f5d3030c0af1d3d5f68971d2a4dbcc

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\[email protected]\content\bg.js

    Filesize

    8KB

    MD5

    14bba8f4a8f614d0663d26b3ce0e1df7

    SHA1

    834fa5958fd39175026d48147c095e25f0d4dbf8

    SHA256

    721ffd94dbc14647cdcad57a02184fa8d6c8730ac707ec820338b20ac480986d

    SHA512

    40dd5c76ed4190ee28d6d916baf5ac141eed9e3a0fefcfa50e6b8df260f5aa72c127424468f02985f0d60572a7f74d6630c9b142c94239925e40b145bfc05e6f

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\[email protected]\content\zy.xul

    Filesize

    225B

    MD5

    be855e9d9c4510f386649e651be80c89

    SHA1

    c53e594138f3d64b6d2f509054ded9e5332ea076

    SHA256

    411b530286e70010de3bfbf10231042c4752df7454b03bbb33cac60b0aead80f

    SHA512

    e887c72a022d6cc7454d1aa42bef228dcda50de212392492d60b365b1eb30046ecbdce4ae99d52a6e6e5f1c3285572bac234a856d5ac92539e986cf53d3cc958

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\[email protected]\install.rdf

    Filesize

    718B

    MD5

    d6aa0d29f2086fb7bbb38f9ad0977208

    SHA1

    5d7398b8f7904077db70f452f77add8115f63d63

    SHA256

    9a624b0bf1d3ea8763bd6a93b5f9e62fab6dc37cc76fa22fc4257c84fe2eb64a

    SHA512

    ee051aceb14b47811b9c909a9128e41210b9987bf64f3b94fa8afef2fcee3078ee6843806fc16f8b2c60ecab637a1960885f659d39c3ad706c5ce98704baabc2

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\51035b77a3fcf.tlb

    Filesize

    2KB

    MD5

    c749bca713cf6481411b5c4eaac4506a

    SHA1

    539cb813dea7e37eff8c1b696eb0ab42c815ab62

    SHA256

    0a94d2086eb6ac57ba5ee365d3f6f64f33e7c8d18419f04715460bc04ebddf2d

    SHA512

    11b3b333b97b1bbbbbf01b6d367188698470877e180a3854ec9762f706755156136b404f2b95a7304a890686d8f5f697232e6c28497aca20e0aa76988b0f179a

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\dbpgfgmggnfehaagnmhclkfhoflgllcf\51035b77a3db57.58540848.js

    Filesize

    4KB

    MD5

    5282ee6cb7bad6d96e79424b29060439

    SHA1

    73e120ae5f8f7aa420eec12021c2db188b17d4a8

    SHA256

    be3cf796f529599bd11bf622aed0e2d1ea8ec8385dc2e9e5c2e8db57aed67e76

    SHA512

    1601be750931ba05e234224d5e18887bc85e6bce69c07e311cb513e3db20f10c897ab9f0d9a3f1a07b2bbf5e9a9e2829824048e639997e90d0099e590ae513e9

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\dbpgfgmggnfehaagnmhclkfhoflgllcf\background.html

    Filesize

    161B

    MD5

    c4c26a94b80ab5b6f67c02a0442dd094

    SHA1

    8ccf4cf00964059d58911a0497dc6631063f2eba

    SHA256

    6e0ac59534c192d253a15913e6db56dabacd70d28475ba20a6cffc1785f3f457

    SHA512

    007b626db2d834617608943feca8b7bf256d08f908518a36b4aa8b38aa43adc585ab815b8f5789d0f8aba329b265c8a40885741ae901320a4a11bb72748cc99b

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\dbpgfgmggnfehaagnmhclkfhoflgllcf\content.js

    Filesize

    197B

    MD5

    5f9891607f65f433b0690bae7088b2c1

    SHA1

    b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

    SHA256

    fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

    SHA512

    76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\dbpgfgmggnfehaagnmhclkfhoflgllcf\lsdb.js

    Filesize

    559B

    MD5

    209b7ae0b6d8c3f9687c979d03b08089

    SHA1

    6449f8bff917115eef4e7488fae61942a869200f

    SHA256

    e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

    SHA512

    1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\dbpgfgmggnfehaagnmhclkfhoflgllcf\manifest.json

    Filesize

    488B

    MD5

    ed45660442671263051e52f6fb5b3a48

    SHA1

    b2b7ee229dc38e1e29b68fae10e14c4eac8ed355

    SHA256

    b69501a6d29ba988508525df99358ecd955b1376eabf23047fc3c727b9fcca08

    SHA512

    1d81c7a03441e2de34e7608751f4172e1856f632a53f69a5c851eef012f4c4091c35c7b78f5d703afe009d19e3037799b9f003b74730dc4e71466f71101bc642

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\dbpgfgmggnfehaagnmhclkfhoflgllcf\sqlite.js

    Filesize

    1KB

    MD5

    8e0a286c44ac7c5939503c65539e3d55

    SHA1

    46b4d4b58f2f51712de2bcf61c1c9ef017f09aaf

    SHA256

    eaa51cee65d4f28dae8c60091de8bdaa7cb2afd2c287fd38a68ae8b0ce00f5af

    SHA512

    cdf6ae3ac26a81d7b20c971f41eedafa3e1896533e31b1b71516ec946debfd363270696dca066dccf9091d4d60a530ca87df86ce27190f62bd8862cc96fa329d

  • C:\Users\Admin\AppData\Local\Temp\7zS84E9.tmp\settings.ini

    Filesize

    7KB

    MD5

    13b089cf2dedd74d1525bda5adaf6a00

    SHA1

    7fc11e828f8cae921e195f827cc39d5b35212c3e

    SHA256

    be127ff4cfbee44a13babf9136a019bc4189b8b9be783bf22df28c2dd379943a

    SHA512

    c9bcca3c1b6acb24f2926647e17072af6236c2eabb915caf40303f423c52c347ae08d6d79769eef76806b8d8de63eea8b080564c2e237a443b697253529c4e93

  • \ProgramData\Download and Sa\51035b77a3fcf.dll

    Filesize

    118KB

    MD5

    44f1dc155d3d083b677f20ed0fab8404

    SHA1

    a696c5a0d50145afde3d3a71f70b1c3006ac2199

    SHA256

    67014a6fc8a77ae480dae9b09f800a1f40a40399ef967f86843a80eb4c9eb470

    SHA512

    04a7098abd589eb1a533af6f89d0d982d2faf9c4e7e29d02abaacf81635b789acfb5ca026f7a0c6b4a263934f0425c69f5225488c450e864f8dc8000ffbf94f6

  • \Users\Admin\AppData\Local\Temp\7zS84E9.tmp\51035b77a3f96.exe

    Filesize

    71KB

    MD5

    b78633fae8aaf5f7e99e9c736f44f9c5

    SHA1

    26fc60e29c459891ac0909470ac6c61a1eca1544

    SHA256

    d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

    SHA512

    3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

  • \Users\Admin\AppData\Local\Temp\nsd869E.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

  • \Users\Admin\AppData\Local\Temp\nsd869E.tmp\nsJSON.dll

    Filesize

    7KB

    MD5

    b9cd1b0fd3af89892348e5cc3108dce7

    SHA1

    f7bc59bf631303facfc970c0da67a73568e1dca6

    SHA256

    49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

    SHA512

    fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

  • memory/2716-80-0x00000000745F0000-0x00000000745FA000-memory.dmp

    Filesize

    40KB