Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 08:47

General

  • Target

    61034de4b3639c270db80df12390faaa.exe

  • Size

    126KB

  • MD5

    61034de4b3639c270db80df12390faaa

  • SHA1

    aa9a96e91f531326c2260ad7c7531d0e1a37c5ba

  • SHA256

    8bbe03f0a57a2ddba3a711e4a17473722a2ff754bd0378d60b23190b4bdb6943

  • SHA512

    69ea2d5a1a43fe46c01286c451f7314086bdd5750d2a699226adaae475520547ba885ae1b69cd664cccfa931bb7b1e949816dd646c1b846123e16b4a2f6e74ed

  • SSDEEP

    3072:SKcWmjRrz3ZKcWmjRrz3PtupvLaPGKxyFq7z:hGyGPtupvLyMFI

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61034de4b3639c270db80df12390faaa.exe
    "C:\Users\Admin\AppData\Local\Temp\61034de4b3639c270db80df12390faaa.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Users\Admin\AppData\Local\Temp\YjHxpzbv7MkVcpI.exe
      C:\Users\Admin\AppData\Local\Temp\YjHxpzbv7MkVcpI.exe
      2⤵
      • Executes dropped EXE
      PID:3108
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    382KB

    MD5

    9b309a1cdc914caec10b37020d9f1f20

    SHA1

    5b630504561711aa836abd8e011c4fbf4079efd5

    SHA256

    aa0f86a5bda04276a16a5ee6fe1831ad85394237fff380df7e767a8dc47cddc4

    SHA512

    0043faf455ee667e41bc30d6d4eb0f786dc382610e8fd578d83a3dff97c282dabe072f1ba13446862631fa51e634703c4d91966c2f9656798e5cd86749bd7147

  • C:\Users\Admin\AppData\Local\Temp\YjHxpzbv7MkVcpI.exe

    Filesize

    67KB

    MD5

    50e9d1438f14e3e345db6b9f15473be0

    SHA1

    20b511d23f4df169b10d6cd022e90b3441af038a

    SHA256

    6852f4faa2d0ae8be06c198c40875c9ecc466c2da9f6899b6d1f80e7df80b5e9

    SHA512

    65dcd5c3ee197727beef8c5bfef4073d9ed93c6662827721310dcbc0ea02c8334dbe42a47a2aee1cbe35a2943d6518c93a1d77325e58ad74cb93828b6c691ea9

  • C:\Windows\CTS.exe

    Filesize

    59KB

    MD5

    5efd390d5f95c8191f5ac33c4db4b143

    SHA1

    42d81b118815361daa3007f1a40f1576e9a9e0bc

    SHA256

    6028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74

    SHA512

    720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d

  • memory/1588-0-0x00000000004C0000-0x00000000004D7000-memory.dmp

    Filesize

    92KB

  • memory/1588-8-0x00000000004C0000-0x00000000004D7000-memory.dmp

    Filesize

    92KB

  • memory/3612-11-0x0000000000D50000-0x0000000000D67000-memory.dmp

    Filesize

    92KB

  • memory/3612-22-0x0000000000D50000-0x0000000000D67000-memory.dmp

    Filesize

    92KB