Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 08:47
Behavioral task
behavioral1
Sample
61034de4b3639c270db80df12390faaa.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
61034de4b3639c270db80df12390faaa.exe
Resource
win10v2004-20231215-en
General
-
Target
61034de4b3639c270db80df12390faaa.exe
-
Size
126KB
-
MD5
61034de4b3639c270db80df12390faaa
-
SHA1
aa9a96e91f531326c2260ad7c7531d0e1a37c5ba
-
SHA256
8bbe03f0a57a2ddba3a711e4a17473722a2ff754bd0378d60b23190b4bdb6943
-
SHA512
69ea2d5a1a43fe46c01286c451f7314086bdd5750d2a699226adaae475520547ba885ae1b69cd664cccfa931bb7b1e949816dd646c1b846123e16b4a2f6e74ed
-
SSDEEP
3072:SKcWmjRrz3ZKcWmjRrz3PtupvLaPGKxyFq7z:hGyGPtupvLyMFI
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3108 YjHxpzbv7MkVcpI.exe 3612 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1588-0-0x00000000004C0000-0x00000000004D7000-memory.dmp upx behavioral2/files/0x000200000001e7e1-7.dat upx behavioral2/memory/1588-8-0x00000000004C0000-0x00000000004D7000-memory.dmp upx behavioral2/memory/3612-11-0x0000000000D50000-0x0000000000D67000-memory.dmp upx behavioral2/files/0x0007000000022556-14.dat upx behavioral2/memory/3612-22-0x0000000000D50000-0x0000000000D67000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 61034de4b3639c270db80df12390faaa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 61034de4b3639c270db80df12390faaa.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1588 61034de4b3639c270db80df12390faaa.exe Token: SeDebugPrivilege 3612 CTS.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1588 wrote to memory of 3108 1588 61034de4b3639c270db80df12390faaa.exe 92 PID 1588 wrote to memory of 3108 1588 61034de4b3639c270db80df12390faaa.exe 92 PID 1588 wrote to memory of 3108 1588 61034de4b3639c270db80df12390faaa.exe 92 PID 1588 wrote to memory of 3612 1588 61034de4b3639c270db80df12390faaa.exe 94 PID 1588 wrote to memory of 3612 1588 61034de4b3639c270db80df12390faaa.exe 94 PID 1588 wrote to memory of 3612 1588 61034de4b3639c270db80df12390faaa.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\61034de4b3639c270db80df12390faaa.exe"C:\Users\Admin\AppData\Local\Temp\61034de4b3639c270db80df12390faaa.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\YjHxpzbv7MkVcpI.exeC:\Users\Admin\AppData\Local\Temp\YjHxpzbv7MkVcpI.exe2⤵
- Executes dropped EXE
PID:3108
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
382KB
MD59b309a1cdc914caec10b37020d9f1f20
SHA15b630504561711aa836abd8e011c4fbf4079efd5
SHA256aa0f86a5bda04276a16a5ee6fe1831ad85394237fff380df7e767a8dc47cddc4
SHA5120043faf455ee667e41bc30d6d4eb0f786dc382610e8fd578d83a3dff97c282dabe072f1ba13446862631fa51e634703c4d91966c2f9656798e5cd86749bd7147
-
Filesize
67KB
MD550e9d1438f14e3e345db6b9f15473be0
SHA120b511d23f4df169b10d6cd022e90b3441af038a
SHA2566852f4faa2d0ae8be06c198c40875c9ecc466c2da9f6899b6d1f80e7df80b5e9
SHA51265dcd5c3ee197727beef8c5bfef4073d9ed93c6662827721310dcbc0ea02c8334dbe42a47a2aee1cbe35a2943d6518c93a1d77325e58ad74cb93828b6c691ea9
-
Filesize
59KB
MD55efd390d5f95c8191f5ac33c4db4b143
SHA142d81b118815361daa3007f1a40f1576e9a9e0bc
SHA2566028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74
SHA512720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d