Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 02:37
Behavioral task
behavioral1
Sample
51b31400194eb1f4e0abb841842e79cb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
51b31400194eb1f4e0abb841842e79cb.exe
Resource
win10v2004-20231222-en
General
-
Target
51b31400194eb1f4e0abb841842e79cb.exe
-
Size
108KB
-
MD5
51b31400194eb1f4e0abb841842e79cb
-
SHA1
5a4ad59a0dfc0d29aa7874df6a0bfeb28ea7d4d0
-
SHA256
07fa7d9d94e5f0a52b4e7909026e28f3dd08bf848d13d40d74cc5c65ed2957c9
-
SHA512
190fe79d2acf333af89b08ca76e335ecae92eafe8134445afd3f7ad15fd23598275044ca626a6f421abeff1ed9ac0f4bb6853a84a1b324847853d1422bba93be
-
SSDEEP
3072:SKcWmjRrz3LGVgpRBDiQShYNpwzijdI/XowBu:hG9p7DiU76geu
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2584 oKHmZve8i4J3t3V.exe 2432 CTS.exe -
Loads dropped DLL 1 IoCs
pid Process 1700 51b31400194eb1f4e0abb841842e79cb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1700-1-0x0000000000050000-0x0000000000067000-memory.dmp upx behavioral1/files/0x0009000000012270-13.dat upx behavioral1/memory/1700-11-0x0000000000050000-0x0000000000067000-memory.dmp upx behavioral1/memory/2432-16-0x0000000001220000-0x0000000001237000-memory.dmp upx behavioral1/files/0x000a000000012262-18.dat upx behavioral1/memory/1700-22-0x0000000000090000-0x00000000000A7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 51b31400194eb1f4e0abb841842e79cb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 51b31400194eb1f4e0abb841842e79cb.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1700 51b31400194eb1f4e0abb841842e79cb.exe Token: SeDebugPrivilege 2432 CTS.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2584 1700 51b31400194eb1f4e0abb841842e79cb.exe 28 PID 1700 wrote to memory of 2584 1700 51b31400194eb1f4e0abb841842e79cb.exe 28 PID 1700 wrote to memory of 2584 1700 51b31400194eb1f4e0abb841842e79cb.exe 28 PID 1700 wrote to memory of 2584 1700 51b31400194eb1f4e0abb841842e79cb.exe 28 PID 1700 wrote to memory of 2432 1700 51b31400194eb1f4e0abb841842e79cb.exe 29 PID 1700 wrote to memory of 2432 1700 51b31400194eb1f4e0abb841842e79cb.exe 29 PID 1700 wrote to memory of 2432 1700 51b31400194eb1f4e0abb841842e79cb.exe 29 PID 1700 wrote to memory of 2432 1700 51b31400194eb1f4e0abb841842e79cb.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\51b31400194eb1f4e0abb841842e79cb.exe"C:\Users\Admin\AppData\Local\Temp\51b31400194eb1f4e0abb841842e79cb.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\oKHmZve8i4J3t3V.exeC:\Users\Admin\AppData\Local\Temp\oKHmZve8i4J3t3V.exe2⤵
- Executes dropped EXE
PID:2584
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD59696313b133b34148d3561ebfef0eb1e
SHA19788ffe047724ec01e38b09c4c678fe053d738ab
SHA2567322cd347bc7e01f38f5015beed6adc1d0adda4ec93b50069ef52c74daa54e60
SHA512dc80b22a7be4b0dfb195158ad1b1e7f4ded3471752a8e4f08855135f7142d7d32fec3899828f942c5f0c84fe0d230cbf681704a8360ed46b705eb278f66641b2
-
Filesize
79KB
MD50d72d43513b4d4f54976f48665f9ee9b
SHA1e508d2503919966189a7b689cef0c11f3ac1294f
SHA256dc5d8756996a72b063ae7a8bd424fda2cb1ad456fdac8c79e4ef5245ff3667d8
SHA512859d27909e0c8a50f1d4f6f297f2203dac9801b1ba5f4612f68b6665a9179b05578849ee2cb445a76ce484bd450ed922e736b251d5798b3502d2aa13d5e56d22
-
Filesize
29KB
MD570aa23c9229741a9b52e5ce388a883ac
SHA1b42683e21e13de3f71db26635954d992ebe7119e
SHA2569d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2
SHA512be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5