Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 13:31
Behavioral task
behavioral1
Sample
381f62cf13a811d0176acfbdfb7ffde2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
381f62cf13a811d0176acfbdfb7ffde2.exe
Resource
win10v2004-20231222-en
General
-
Target
381f62cf13a811d0176acfbdfb7ffde2.exe
-
Size
78KB
-
MD5
381f62cf13a811d0176acfbdfb7ffde2
-
SHA1
84b38fffa932b78b179042fc685e4eaedaf44699
-
SHA256
5e15b22616336cf9939825b370560d60d5ff93ea396c73a9edf905fa90e1ca80
-
SHA512
eecee0da1c2ebd09468f49d21452b6ec94c660caef0cebad79b429341f368ad8a9a24915041fb37ac33391746094ce031b9b00291e27b58e2f0ecd143d01e15c
-
SSDEEP
1536:SKcR4mjD9r823FHKcR4mjD9r823Fx3r4EGQO8JMVbbj:SKcWmjRrz3ZKcWmjRrz3X3B4
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4084 4kWtui9YgkP70Bb.exe 1044 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3096-0-0x0000000000F40000-0x0000000000F57000-memory.dmp upx behavioral2/memory/3096-7-0x0000000000F40000-0x0000000000F57000-memory.dmp upx behavioral2/memory/1044-9-0x0000000000050000-0x0000000000067000-memory.dmp upx behavioral2/files/0x0007000000023232-8.dat upx behavioral2/files/0x0007000000023232-6.dat upx behavioral2/files/0x0003000000022778-13.dat upx behavioral2/memory/1044-32-0x0000000000050000-0x0000000000067000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 381f62cf13a811d0176acfbdfb7ffde2.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 381f62cf13a811d0176acfbdfb7ffde2.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3096 381f62cf13a811d0176acfbdfb7ffde2.exe Token: SeDebugPrivilege 1044 CTS.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3096 wrote to memory of 4084 3096 381f62cf13a811d0176acfbdfb7ffde2.exe 17 PID 3096 wrote to memory of 4084 3096 381f62cf13a811d0176acfbdfb7ffde2.exe 17 PID 3096 wrote to memory of 1044 3096 381f62cf13a811d0176acfbdfb7ffde2.exe 15 PID 3096 wrote to memory of 1044 3096 381f62cf13a811d0176acfbdfb7ffde2.exe 15 PID 3096 wrote to memory of 1044 3096 381f62cf13a811d0176acfbdfb7ffde2.exe 15
Processes
-
C:\Users\Admin\AppData\Local\Temp\381f62cf13a811d0176acfbdfb7ffde2.exe"C:\Users\Admin\AppData\Local\Temp\381f62cf13a811d0176acfbdfb7ffde2.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Users\Admin\AppData\Local\Temp\4kWtui9YgkP70Bb.exeC:\Users\Admin\AppData\Local\Temp\4kWtui9YgkP70Bb.exe2⤵
- Executes dropped EXE
PID:4084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
MD53b8bd8359058bd4dfa89efb9dea545fb
SHA15a5b7997d83a07e192f1b996c753aa1e23c71dc4
SHA256772f6a24fa5ac949e229666b64947722ecf3b92c4bb4cbdf70f039667741d925
SHA512d66d5a38815880a95956837f366f87c52987e83481a0eca0d94b568d08442db4886c37b41fd2f4537112b12a2c1df961ee95a6257c5fa5f0a16c815020ce8654
-
Filesize
18KB
MD53d02b1d79394fe13058ab40a0abfb133
SHA1d6c2b092f1bc79a1b53975bc9b34a5a3c4529ba9
SHA25641151a38436ceb8acaac016619e3eeb99b671cd13c024d6d8e91fa89b7697900
SHA5120b312a77f3a422f695e8b7953f03db31941fd24540e7162221dc8fefcc323e16ef7cf3ce6f82dc1f7e8bd78214301b082de518878a803f989ab85485918e00bc
-
Filesize
59KB
MD55efd390d5f95c8191f5ac33c4db4b143
SHA142d81b118815361daa3007f1a40f1576e9a9e0bc
SHA2566028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74
SHA512720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d
-
Filesize
57KB
MD59d7b6a662603e4a3f821bed67e1414ed
SHA17f26f88357b8de1fcf99cb0ef53385de9cff585b
SHA25653ac2a14d6d9f7d2b361a24c664c4eb2f062186ecf438c7e93aa79bcb356c4d8
SHA51298f4f07e7156498da244a2709efaff4b98f27145bfe1a6d42455e650cab22f383bf57122793241df2e7df9484d2b247804993ecd0565bc5ff1e88d10fc6492e1