Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 01:53
Behavioral task
behavioral1
Sample
4ab4dc72b166871fe940cefb4ef2c8d6.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4ab4dc72b166871fe940cefb4ef2c8d6.exe
Resource
win10v2004-20231215-en
General
-
Target
4ab4dc72b166871fe940cefb4ef2c8d6.exe
-
Size
30KB
-
MD5
4ab4dc72b166871fe940cefb4ef2c8d6
-
SHA1
04a591ad29cdf25c57e42402ebaf75670c10a800
-
SHA256
645d3303de9dd7389ae29d0581cdabfa8dd09ef593c234471bb85ea58f28ba35
-
SHA512
53ceea4f553557fb0da27b27090f7076ad15af43243892cbaf362a34efbc840d753da4a29bac3fd587835a108508e6899a597f36b35fa200cdd5f3e4925aa233
-
SSDEEP
768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFQI:SKcR4mjD9r823FX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1996 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2940-1-0x00000000001A0000-0x00000000001B7000-memory.dmp upx behavioral1/memory/2940-9-0x00000000001A0000-0x00000000001B7000-memory.dmp upx behavioral1/files/0x000a000000012704-10.dat upx behavioral1/memory/1996-12-0x00000000008C0000-0x00000000008D7000-memory.dmp upx behavioral1/files/0x000a0000000126af-14.dat upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 4ab4dc72b166871fe940cefb4ef2c8d6.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 4ab4dc72b166871fe940cefb4ef2c8d6.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2940 4ab4dc72b166871fe940cefb4ef2c8d6.exe Token: SeDebugPrivilege 1996 CTS.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2940 wrote to memory of 1996 2940 4ab4dc72b166871fe940cefb4ef2c8d6.exe 28 PID 2940 wrote to memory of 1996 2940 4ab4dc72b166871fe940cefb4ef2c8d6.exe 28 PID 2940 wrote to memory of 1996 2940 4ab4dc72b166871fe940cefb4ef2c8d6.exe 28 PID 2940 wrote to memory of 1996 2940 4ab4dc72b166871fe940cefb4ef2c8d6.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ab4dc72b166871fe940cefb4ef2c8d6.exe"C:\Users\Admin\AppData\Local\Temp\4ab4dc72b166871fe940cefb4ef2c8d6.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5b442fe87007b577f36ce84aeee0f0161
SHA1546c7fbcf86c57c9fa77bd048462f77fc413f210
SHA256303af35a1274f22b35d04c5a624eea8a3798b6c4f1412510548ace17eede3321
SHA51217e87cd7b8266d9d7e881c7db35e3190ca413b49bfc7eec02774fffe8d31619059bea91e38629670e973cb15d1db2ec661795ccbd515ab5c21cbe2499a47ca7a
-
Filesize
29KB
MD570aa23c9229741a9b52e5ce388a883ac
SHA1b42683e21e13de3f71db26635954d992ebe7119e
SHA2569d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2
SHA512be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5