Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
175s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
79e4dff23f4655df08a43192b1806682.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
79e4dff23f4655df08a43192b1806682.exe
Resource
win10v2004-20231215-en
General
-
Target
79e4dff23f4655df08a43192b1806682.exe
-
Size
743KB
-
MD5
79e4dff23f4655df08a43192b1806682
-
SHA1
70a7090ee5175dcca7d4b57ee00c2856543c14d3
-
SHA256
c64176e0fdefcb2b1fdb9a8a6fb541f103a7f9acba8a83812304802889ca1a84
-
SHA512
92ce4e2d5f2c36c8d7e6c35950ca3caeb7823aec0b5d21c360084f87fa6b2ff7407bc4c70638dd66569af8c9e11b250d6b6bab6a50911555008d66bd70b3ba8a
-
SSDEEP
12288:FUr/hVLFKNCmWDoF3tCLTmXKNAY7S5mFkQOUCJLA8:FUj7FKNkDoF3tQyXKN+lQPCRz
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
letmein12321
Signatures
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000023251-34.dat acprotect behavioral2/files/0x000a00000002324a-36.dat acprotect behavioral2/files/0x0006000000023252-40.dat acprotect behavioral2/files/0x0006000000023254-44.dat acprotect behavioral2/files/0x0006000000023253-43.dat acprotect behavioral2/memory/2840-46-0x0000000060220000-0x0000000060229000-memory.dmp acprotect behavioral2/memory/2840-52-0x0000000060220000-0x0000000060229000-memory.dmp acprotect -
Executes dropped EXE 1 IoCs
pid Process 2840 FirePassword.exe -
Loads dropped DLL 5 IoCs
pid Process 2840 FirePassword.exe 2840 FirePassword.exe 2840 FirePassword.exe 2840 FirePassword.exe 2840 FirePassword.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000d00000002315b-29.dat upx behavioral2/memory/2840-32-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/files/0x000a000000023251-34.dat upx behavioral2/files/0x000a00000002324a-36.dat upx behavioral2/files/0x0006000000023252-40.dat upx behavioral2/files/0x0006000000023254-44.dat upx behavioral2/files/0x0006000000023253-43.dat upx behavioral2/memory/2840-37-0x0000000060170000-0x00000000601D7000-memory.dmp upx behavioral2/memory/2840-45-0x0000000060210000-0x000000006021A000-memory.dmp upx behavioral2/memory/2840-46-0x0000000060220000-0x0000000060229000-memory.dmp upx behavioral2/memory/2840-47-0x0000000060260000-0x00000000602BF000-memory.dmp upx behavioral2/memory/2840-48-0x0000000060140000-0x000000006016D000-memory.dmp upx behavioral2/memory/2840-49-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/2840-52-0x0000000060220000-0x0000000060229000-memory.dmp upx behavioral2/memory/2840-51-0x0000000060210000-0x000000006021A000-memory.dmp upx behavioral2/memory/2840-53-0x0000000060260000-0x00000000602BF000-memory.dmp upx behavioral2/memory/2840-50-0x0000000060140000-0x000000006016D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\79e4dff23f4655df08a43192b1806682.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" 79e4dff23f4655df08a43192b1806682.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3188 79e4dff23f4655df08a43192b1806682.exe 3188 79e4dff23f4655df08a43192b1806682.exe 3188 79e4dff23f4655df08a43192b1806682.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3188 79e4dff23f4655df08a43192b1806682.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3188 79e4dff23f4655df08a43192b1806682.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3188 79e4dff23f4655df08a43192b1806682.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3188 wrote to memory of 2712 3188 79e4dff23f4655df08a43192b1806682.exe 98 PID 3188 wrote to memory of 2712 3188 79e4dff23f4655df08a43192b1806682.exe 98 PID 3188 wrote to memory of 1760 3188 79e4dff23f4655df08a43192b1806682.exe 99 PID 3188 wrote to memory of 1760 3188 79e4dff23f4655df08a43192b1806682.exe 99 PID 1760 wrote to memory of 2840 1760 cmd.exe 103 PID 1760 wrote to memory of 2840 1760 cmd.exe 103 PID 1760 wrote to memory of 2840 1760 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\79e4dff23f4655df08a43192b1806682.exe"C:\Users\Admin\AppData\Local\Temp\79e4dff23f4655df08a43192b1806682.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SYSTEM32\cmd.execmd /C cd C:\Users\Admin\AppData\Roaming\Microsoft2⤵PID:2712
-
-
C:\Windows\SYSTEM32\cmd.execmd /C C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe >C:\Users\Admin\AppData\Roaming\Microsoft\Error.txt2⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exeC:\Users\Admin\AppData\Roaming\Microsoft\FirePassword.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
283B
MD51d870fe37141ae58bc38bc6794374781
SHA18b20b3096f36fe4d343fc770c5f29a7983760d48
SHA256c51d09b0f2fe56f42ea2a852e6de4d8a45e5dbaa610c4caabb30c9c0ec3f8360
SHA512575b36d30e80c75fe3bb97ba057260f283286f88f5e6b008b806402acf6d94d081ddae3414c531522d2bca51327732f83596fbaf1550d827574a8b4496b03e79
-
Filesize
200KB
MD5dab03dc446a8d2b809ce7aade0fab8b4
SHA13c6c19c9c6612653aab2cce45a6507547142fab1
SHA2562c19dd25af9acc7ae31881c28108acb64a6b544622b97aebb0e55af783402e00
SHA51252ae8830e522b5314820edaca9cddc2cddb2e477874a7207bc4f65a8d22d94a3d5909000c113cb417db3d6c00e8f86306a518ff168f815e9029959977b833dc4
-
Filesize
72KB
MD572414dfb0b112c664d2c8d1215674e09
SHA150a1e61309741e92fe3931d8eb606f8ada582c0a
SHA25669e73fea2210adc2ae0837ac98b46980a09fe91c07f181a28fda195e2b9e6b71
SHA51241428624573b4a191b33657ed9ad760b500c5640f3d62b758869a17857edc68f90bc10d7a5e720029519c0d49b5ca0fa8579743e80b200ef331e41efde1dc8c9
-
Filesize
172KB
MD57ddbd64d87c94fd0b5914688093dd5c2
SHA1d49d1f79efae8a5f58e6f713e43360117589efeb
SHA256769703fb1ba6c95fb6c889e8a9baaea309e62d0f3ca444d01cc6b495c0f722d1
SHA51260eaad58c3c4894f1673723eb28ddb42b681ff7aafe7a29ff8bf87a2da6595c16d1f8449096accdb89bd6cda6454eb90470e71dde7c5bd16abd0f80e115cfa2d
-
Filesize
8KB
MD5c73ec58b42e66443fafc03f3a84dcef9
SHA15e91f467fe853da2c437f887162bccc6fd9d9dbe
SHA2562dc0171b83c406db6ec9389b438828246b282862d2b8bdf2f5b75aec932a69f7
SHA5126318e831d8f38525e2e49b5a1661440cd8b1f3d2afc6813bb862c21d88d213c4675a8ec2a413b14fbdca896c63b65a7da6ec9595893b352ade8979e7e86a7fcf
-
Filesize
6KB
MD5ee44d5d780521816c906568a8798ed2f
SHA12da1b06d5de378cbfc7f2614a0f280f59f2b1224
SHA25650b2735318233d6c87b6efccccc23a0e3216d2870c67f2f193cc1c83c7c879fc
SHA512634a1cd2baaef29b4fe7c7583c04406bb2ea3a3c93294b31f621652844541e7c549da1a31619f657207327604c261976e15845571ee1efe5416f1b021d361da8
-
Filesize
155KB
MD5e846285b19405b11c8f19c1ed0a57292
SHA12c20cf37394be48770cd6d396878a3ca70066fd0
SHA256251f0094b6b6537df3d3ce7c2663726616f06cfb9b6de90efabd67de2179a477
SHA512b622ff07ae2f77e886a93987a9a922e80032e9041ed41503f0e38abb8c344eb922d154ade29e52454d0a1ad31596c4085f4bd942e4412af9f0698183acd75db7