Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/01/2024, 23:40
General
-
Target
59b5d522f7984b06107ec79805b727e8.exe
-
Size
3.4MB
-
MD5
59b5d522f7984b06107ec79805b727e8
-
SHA1
4ab71f90d3aea09297d8686d8e02e12bfc566ee0
-
SHA256
1622cc5cee3c0ce49f88d8db78c1d6af35a62083ab50573448bcc4ff175c891c
-
SHA512
3a7c09226e32192c8e1f9003ce05e9c047c21f460edcf53130f9147efe09a110ec3351b9399935842382548543a9702d6e536dd8567a4cc175b5bb4fe19adee7
-
SSDEEP
98304:IRS6nfSOQZOt+CW+7EELhF3gxpNOf2k2Y/PL:Ikj8NBFwxpNOuk2y
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\59b5d522f7984b06107ec79805b727e8.exe"C:\Users\Admin\AppData\Local\Temp\59b5d522f7984b06107ec79805b727e8.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\803MP1k961c.exe"C:\Users\Admin\AppData\Local\Temp\803MP1k961c.exe" QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXDU5YjVkNTIyZjc5ODRiMDYxMDdlYzc5ODA1YjcyN2U4LmV4ZQ==2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C sc stop "SysMain" & sc config "SysMain" start=disabled3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop "SysMain"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config "SysMain" start=disabled4⤵
- Launches sc.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD57dc63af72c43cd5006d98e7a675d28de
SHA11e026a1d23bc1bb633a418a79a5a6d38f8c95245
SHA256125ae354edcbf522780253f4334e0d04d67b8a328e710c898b8784ece2c092c5
SHA51258d22b69dcde5c85a7fdb8994e7a022f74934cc9d149333c91d8bd2b60e9ee7d981d43607b443b59b0a6097ef1dd7314bafd49134ad7573833c111e53ff89446
-
Filesize
2.1MB
MD5e5a8bd5feb1d7c87c6265a1cd45a9e74
SHA14d05d2240615309de94d4a133288b0d068dc0e2d
SHA25636b536d45a5db6e72b99074db8475e179d16b4f58b1bd411710b4aabc288fd64
SHA512951c0d9f2bc9bbccc7ed11783a1bc793ea97bbeeec8f9a9f291cb709298b565c87e446c6c76e0fcbf0f30fa1a6f4298154b5a238f74174dcd8617ed85f778286
-
Filesize
2.8MB
MD5f171e891aa48e45bcf106f1e108c788c
SHA1244e82d530530edda983e20196fa29fa220131ea
SHA256c01ff1a5a2f099e448905c8973b655489f87c876891ad50a40e141d11236f5e3
SHA5125da7779c1facdd8ed54fdab7f667140f98ba0f96dbd78e20f4f5d6d20221a7bf79260baca85181df961474ac59821693552231efcf1e409f3948de6debce5b98
-
Filesize
456KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
3.1MB
-
Filesize
32KB
-
Filesize
200KB
-
Filesize
2.9MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
16KB
-
Filesize
3.1MB
-
Filesize
744KB
-
Filesize
192KB
-
Filesize
24KB
-
Filesize
624KB
-
Filesize
24KB
-
Filesize
16KB
-
Filesize
4.2MB