Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    175s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 15:44

General

  • Target

    79e4dff23f4655df08a43192b1806682.exe

  • Size

    743KB

  • MD5

    79e4dff23f4655df08a43192b1806682

  • SHA1

    70a7090ee5175dcca7d4b57ee00c2856543c14d3

  • SHA256

    c64176e0fdefcb2b1fdb9a8a6fb541f103a7f9acba8a83812304802889ca1a84

  • SHA512

    92ce4e2d5f2c36c8d7e6c35950ca3caeb7823aec0b5d21c360084f87fa6b2ff7407bc4c70638dd66569af8c9e11b250d6b6bab6a50911555008d66bd70b3ba8a

  • SSDEEP

    12288:FUr/hVLFKNCmWDoF3tCLTmXKNAY7S5mFkQOUCJLA8:FUj7FKNkDoF3tQyXKN+lQPCRz

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    letmein12321

Signatures

  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79e4dff23f4655df08a43192b1806682.exe
    "C:\Users\Admin\AppData\Local\Temp\79e4dff23f4655df08a43192b1806682.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /C cd C:\Users\Admin\AppData\Roaming\Microsoft
      2⤵
        PID:2712
      • C:\Windows\SYSTEM32\cmd.exe
        cmd /C C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe >C:\Users\Admin\AppData\Roaming\Microsoft\Error.txt
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2840

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Error.txt

      Filesize

      283B

      MD5

      1d870fe37141ae58bc38bc6794374781

      SHA1

      8b20b3096f36fe4d343fc770c5f29a7983760d48

      SHA256

      c51d09b0f2fe56f42ea2a852e6de4d8a45e5dbaa610c4caabb30c9c0ec3f8360

      SHA512

      575b36d30e80c75fe3bb97ba057260f283286f88f5e6b008b806402acf6d94d081ddae3414c531522d2bca51327732f83596fbaf1550d827574a8b4496b03e79

    • C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe

      Filesize

      200KB

      MD5

      dab03dc446a8d2b809ce7aade0fab8b4

      SHA1

      3c6c19c9c6612653aab2cce45a6507547142fab1

      SHA256

      2c19dd25af9acc7ae31881c28108acb64a6b544622b97aebb0e55af783402e00

      SHA512

      52ae8830e522b5314820edaca9cddc2cddb2e477874a7207bc4f65a8d22d94a3d5909000c113cb417db3d6c00e8f86306a518ff168f815e9029959977b833dc4

    • C:\Users\Admin\AppData\Roaming\Microsoft\nspr4.dll

      Filesize

      72KB

      MD5

      72414dfb0b112c664d2c8d1215674e09

      SHA1

      50a1e61309741e92fe3931d8eb606f8ada582c0a

      SHA256

      69e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71

      SHA512

      41428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9

    • C:\Users\Admin\AppData\Roaming\Microsoft\nss3.dll

      Filesize

      172KB

      MD5

      7ddbd64d87c94fd0b5914688093dd5c2

      SHA1

      d49d1f79efae8a5f58e6f713e43360117589efeb

      SHA256

      769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1

      SHA512

      60eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d

    • C:\Users\Admin\AppData\Roaming\Microsoft\plc4.dll

      Filesize

      8KB

      MD5

      c73ec58b42e66443fafc03f3a84dcef9

      SHA1

      5e91f467fe853da2c437f887162bccc6fd9d9dbe

      SHA256

      2dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7

      SHA512

      6318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf

    • C:\Users\Admin\AppData\Roaming\Microsoft\plds4.dll

      Filesize

      6KB

      MD5

      ee44d5d780521816c906568a8798ed2f

      SHA1

      2da1b06d5de378cbfc7f2614a0f280f59f2b1224

      SHA256

      50b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc

      SHA512

      634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8

    • C:\Users\Admin\AppData\Roaming\Microsoft\softokn3.dll

      Filesize

      155KB

      MD5

      e846285b19405b11c8f19c1ed0a57292

      SHA1

      2c20cf37394be48770cd6d396878a3ca70066fd0

      SHA256

      251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477

      SHA512

      b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7

    • memory/2840-51-0x0000000060210000-0x000000006021A000-memory.dmp

      Filesize

      40KB

    • memory/2840-47-0x0000000060260000-0x00000000602BF000-memory.dmp

      Filesize

      380KB

    • memory/2840-46-0x0000000060220000-0x0000000060229000-memory.dmp

      Filesize

      36KB

    • memory/2840-45-0x0000000060210000-0x000000006021A000-memory.dmp

      Filesize

      40KB

    • memory/2840-37-0x0000000060170000-0x00000000601D7000-memory.dmp

      Filesize

      412KB

    • memory/2840-48-0x0000000060140000-0x000000006016D000-memory.dmp

      Filesize

      180KB

    • memory/2840-49-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2840-52-0x0000000060220000-0x0000000060229000-memory.dmp

      Filesize

      36KB

    • memory/2840-53-0x0000000060260000-0x00000000602BF000-memory.dmp

      Filesize

      380KB

    • memory/2840-50-0x0000000060140000-0x000000006016D000-memory.dmp

      Filesize

      180KB

    • memory/2840-32-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/3188-10-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-13-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-25-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-27-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-18-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-30-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-31-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-16-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-17-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-15-0x00007FFA311E0000-0x00007FFA31B81000-memory.dmp

      Filesize

      9.6MB

    • memory/3188-14-0x000000001C130000-0x000000001C149000-memory.dmp

      Filesize

      100KB

    • memory/3188-22-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-12-0x00007FFA311E0000-0x00007FFA31B81000-memory.dmp

      Filesize

      9.6MB

    • memory/3188-11-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-0-0x000000001AFE0000-0x000000001B086000-memory.dmp

      Filesize

      664KB

    • memory/3188-9-0x000000001E3E0000-0x000000001E442000-memory.dmp

      Filesize

      392KB

    • memory/3188-8-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-7-0x000000001BCD0000-0x000000001BD1C000-memory.dmp

      Filesize

      304KB

    • memory/3188-6-0x0000000000B20000-0x0000000000B28000-memory.dmp

      Filesize

      32KB

    • memory/3188-5-0x000000001BB70000-0x000000001BC0C000-memory.dmp

      Filesize

      624KB

    • memory/3188-4-0x00007FFA311E0000-0x00007FFA31B81000-memory.dmp

      Filesize

      9.6MB

    • memory/3188-3-0x000000001B600000-0x000000001BACE000-memory.dmp

      Filesize

      4.8MB

    • memory/3188-2-0x0000000000B60000-0x0000000000B70000-memory.dmp

      Filesize

      64KB

    • memory/3188-1-0x00007FFA311E0000-0x00007FFA31B81000-memory.dmp

      Filesize

      9.6MB