Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 16:05
Behavioral task
behavioral1
Sample
46a412a3a5ab708b5eac42d51688e34a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
46a412a3a5ab708b5eac42d51688e34a.exe
Resource
win10v2004-20231215-en
General
-
Target
46a412a3a5ab708b5eac42d51688e34a.exe
-
Size
30KB
-
MD5
46a412a3a5ab708b5eac42d51688e34a
-
SHA1
bd1f15955e73f1624ed6b6783c8a6ad230318b8b
-
SHA256
c3bbbb934219c7fc8e17f8f6f789d437d73d0c42a7603168d9f0da740554e1eb
-
SHA512
6c1bf004ab64b65992cf335b3d68d9089307ae44d3f4e4345f89268d608beaf80115b24dcebb7e4f4e5b33a6266f7eb586bdf5b520e5e3ef805a2fcf99f4d7cb
-
SSDEEP
768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFCI:SKcR4mjD9r823Fz
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4908 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4776-0-0x0000000000BC0000-0x0000000000BD7000-memory.dmp upx behavioral2/memory/4908-9-0x0000000000B60000-0x0000000000B77000-memory.dmp upx behavioral2/files/0x0007000000023209-8.dat upx behavioral2/memory/4776-7-0x0000000000BC0000-0x0000000000BD7000-memory.dmp upx behavioral2/files/0x000300000001e713-12.dat upx behavioral2/files/0x00050000000006e9-29.dat upx behavioral2/memory/4908-31-0x0000000000B60000-0x0000000000B77000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 46a412a3a5ab708b5eac42d51688e34a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 46a412a3a5ab708b5eac42d51688e34a.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4776 46a412a3a5ab708b5eac42d51688e34a.exe Token: SeDebugPrivilege 4908 CTS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4776 wrote to memory of 4908 4776 46a412a3a5ab708b5eac42d51688e34a.exe 89 PID 4776 wrote to memory of 4908 4776 46a412a3a5ab708b5eac42d51688e34a.exe 89 PID 4776 wrote to memory of 4908 4776 46a412a3a5ab708b5eac42d51688e34a.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\46a412a3a5ab708b5eac42d51688e34a.exe"C:\Users\Admin\AppData\Local\Temp\46a412a3a5ab708b5eac42d51688e34a.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
MD541cfa376d8f754552b973224d98c21e9
SHA1855518aa6c56394750bbf7f4db233f6805621347
SHA2563b5ff56f994cacb3abad8a9793572d119d1ed9fd8783f210c244b59bb48a61fb
SHA512ee63d600ab89e04cfed91f668ef06730f862182698afb2d2816d41c90c6b46e7173fe215a03647df37091c6a7d7f59f3b56f010d7fcedd07a635c0c4298ee8a8
-
Filesize
30KB
MD5a75103560872b1d11397c0435a3f9046
SHA11e9158d2cdfc0db0f84c1f89fb57938bc690872f
SHA25666c4a5cc7fd4ddb9e262162ca09cea079025052b76bcbec048e125ae9fb3404d
SHA5122476b520474311e25e726c2e61e9627c6e220efdcfca7c56ecd8ebf92777eb611d662f79a3a417d8afc807c6add5d867446c8e4685bb32cc250d023dd7db490a
-
Filesize
29KB
MD570aa23c9229741a9b52e5ce388a883ac
SHA1b42683e21e13de3f71db26635954d992ebe7119e
SHA2569d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2
SHA512be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5