Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    162s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 16:05

General

  • Target

    46a412a3a5ab708b5eac42d51688e34a.exe

  • Size

    30KB

  • MD5

    46a412a3a5ab708b5eac42d51688e34a

  • SHA1

    bd1f15955e73f1624ed6b6783c8a6ad230318b8b

  • SHA256

    c3bbbb934219c7fc8e17f8f6f789d437d73d0c42a7603168d9f0da740554e1eb

  • SHA512

    6c1bf004ab64b65992cf335b3d68d9089307ae44d3f4e4345f89268d608beaf80115b24dcebb7e4f4e5b33a6266f7eb586bdf5b520e5e3ef805a2fcf99f4d7cb

  • SSDEEP

    768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFCI:SKcR4mjD9r823Fz

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46a412a3a5ab708b5eac42d51688e34a.exe
    "C:\Users\Admin\AppData\Local\Temp\46a412a3a5ab708b5eac42d51688e34a.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4908

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    352KB

    MD5

    41cfa376d8f754552b973224d98c21e9

    SHA1

    855518aa6c56394750bbf7f4db233f6805621347

    SHA256

    3b5ff56f994cacb3abad8a9793572d119d1ed9fd8783f210c244b59bb48a61fb

    SHA512

    ee63d600ab89e04cfed91f668ef06730f862182698afb2d2816d41c90c6b46e7173fe215a03647df37091c6a7d7f59f3b56f010d7fcedd07a635c0c4298ee8a8

  • C:\Users\Admin\AppData\Local\Temp\E7DV3HdPsH0tkTr.exe

    Filesize

    30KB

    MD5

    a75103560872b1d11397c0435a3f9046

    SHA1

    1e9158d2cdfc0db0f84c1f89fb57938bc690872f

    SHA256

    66c4a5cc7fd4ddb9e262162ca09cea079025052b76bcbec048e125ae9fb3404d

    SHA512

    2476b520474311e25e726c2e61e9627c6e220efdcfca7c56ecd8ebf92777eb611d662f79a3a417d8afc807c6add5d867446c8e4685bb32cc250d023dd7db490a

  • C:\Windows\CTS.exe

    Filesize

    29KB

    MD5

    70aa23c9229741a9b52e5ce388a883ac

    SHA1

    b42683e21e13de3f71db26635954d992ebe7119e

    SHA256

    9d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2

    SHA512

    be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5

  • memory/4776-0-0x0000000000BC0000-0x0000000000BD7000-memory.dmp

    Filesize

    92KB

  • memory/4776-7-0x0000000000BC0000-0x0000000000BD7000-memory.dmp

    Filesize

    92KB

  • memory/4908-9-0x0000000000B60000-0x0000000000B77000-memory.dmp

    Filesize

    92KB

  • memory/4908-31-0x0000000000B60000-0x0000000000B77000-memory.dmp

    Filesize

    92KB