Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 13:31

General

  • Target

    381f62cf13a811d0176acfbdfb7ffde2.exe

  • Size

    78KB

  • MD5

    381f62cf13a811d0176acfbdfb7ffde2

  • SHA1

    84b38fffa932b78b179042fc685e4eaedaf44699

  • SHA256

    5e15b22616336cf9939825b370560d60d5ff93ea396c73a9edf905fa90e1ca80

  • SHA512

    eecee0da1c2ebd09468f49d21452b6ec94c660caef0cebad79b429341f368ad8a9a24915041fb37ac33391746094ce031b9b00291e27b58e2f0ecd143d01e15c

  • SSDEEP

    1536:SKcR4mjD9r823FHKcR4mjD9r823Fx3r4EGQO8JMVbbj:SKcWmjRrz3ZKcWmjRrz3X3B4

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\381f62cf13a811d0176acfbdfb7ffde2.exe
    "C:\Users\Admin\AppData\Local\Temp\381f62cf13a811d0176acfbdfb7ffde2.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3096
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1044
    • C:\Users\Admin\AppData\Local\Temp\4kWtui9YgkP70Bb.exe
      C:\Users\Admin\AppData\Local\Temp\4kWtui9YgkP70Bb.exe
      2⤵
      • Executes dropped EXE
      PID:4084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    180KB

    MD5

    3b8bd8359058bd4dfa89efb9dea545fb

    SHA1

    5a5b7997d83a07e192f1b996c753aa1e23c71dc4

    SHA256

    772f6a24fa5ac949e229666b64947722ecf3b92c4bb4cbdf70f039667741d925

    SHA512

    d66d5a38815880a95956837f366f87c52987e83481a0eca0d94b568d08442db4886c37b41fd2f4537112b12a2c1df961ee95a6257c5fa5f0a16c815020ce8654

  • C:\Users\Admin\AppData\Local\Temp\4kWtui9YgkP70Bb.exe

    Filesize

    18KB

    MD5

    3d02b1d79394fe13058ab40a0abfb133

    SHA1

    d6c2b092f1bc79a1b53975bc9b34a5a3c4529ba9

    SHA256

    41151a38436ceb8acaac016619e3eeb99b671cd13c024d6d8e91fa89b7697900

    SHA512

    0b312a77f3a422f695e8b7953f03db31941fd24540e7162221dc8fefcc323e16ef7cf3ce6f82dc1f7e8bd78214301b082de518878a803f989ab85485918e00bc

  • C:\Windows\CTS.exe

    Filesize

    59KB

    MD5

    5efd390d5f95c8191f5ac33c4db4b143

    SHA1

    42d81b118815361daa3007f1a40f1576e9a9e0bc

    SHA256

    6028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74

    SHA512

    720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d

  • C:\Windows\CTS.exe

    Filesize

    57KB

    MD5

    9d7b6a662603e4a3f821bed67e1414ed

    SHA1

    7f26f88357b8de1fcf99cb0ef53385de9cff585b

    SHA256

    53ac2a14d6d9f7d2b361a24c664c4eb2f062186ecf438c7e93aa79bcb356c4d8

    SHA512

    98f4f07e7156498da244a2709efaff4b98f27145bfe1a6d42455e650cab22f383bf57122793241df2e7df9484d2b247804993ecd0565bc5ff1e88d10fc6492e1

  • memory/1044-9-0x0000000000050000-0x0000000000067000-memory.dmp

    Filesize

    92KB

  • memory/1044-32-0x0000000000050000-0x0000000000067000-memory.dmp

    Filesize

    92KB

  • memory/3096-0-0x0000000000F40000-0x0000000000F57000-memory.dmp

    Filesize

    92KB

  • memory/3096-7-0x0000000000F40000-0x0000000000F57000-memory.dmp

    Filesize

    92KB