Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 08:12
Behavioral task
behavioral1
Sample
64e81ece3d7e4b24e6c14e37a6047217.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
64e81ece3d7e4b24e6c14e37a6047217.exe
Resource
win10v2004-20231215-en
General
-
Target
64e81ece3d7e4b24e6c14e37a6047217.exe
-
Size
126KB
-
MD5
64e81ece3d7e4b24e6c14e37a6047217
-
SHA1
6be2d5f299b2925787e9d6ad7e407f9c38b7ebcc
-
SHA256
de4d26d256868c168d4dc8ea9841bd0cfe9f382eadef9963d7326f14bf9cd28f
-
SHA512
09259e420bc7ed093f5d5de6f0fe41519e1fa5ea31bf1823dd7c177a7229e1035e8edcfce98af6b913c953d14af67b2a8dd5618f43bfd343401c94fd32755ffd
-
SSDEEP
3072:SKcWmjRrz3ZKcWmjRrz3GzBmFzMlPJ+fXSsjlyGfihuoAGS:hGyGGVGqPJXsj78Ad
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2536 08wmU7nW53NnlaX.exe 5084 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1584-0-0x0000000000E00000-0x0000000000E17000-memory.dmp upx behavioral2/memory/5084-9-0x00000000006F0000-0x0000000000707000-memory.dmp upx behavioral2/files/0x0008000000023218-8.dat upx behavioral2/files/0x000300000002276d-13.dat upx behavioral2/memory/1584-7-0x0000000000E00000-0x0000000000E17000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 64e81ece3d7e4b24e6c14e37a6047217.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 64e81ece3d7e4b24e6c14e37a6047217.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1584 64e81ece3d7e4b24e6c14e37a6047217.exe Token: SeDebugPrivilege 5084 CTS.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1584 wrote to memory of 2536 1584 64e81ece3d7e4b24e6c14e37a6047217.exe 21 PID 1584 wrote to memory of 2536 1584 64e81ece3d7e4b24e6c14e37a6047217.exe 21 PID 1584 wrote to memory of 2536 1584 64e81ece3d7e4b24e6c14e37a6047217.exe 21 PID 1584 wrote to memory of 5084 1584 64e81ece3d7e4b24e6c14e37a6047217.exe 19 PID 1584 wrote to memory of 5084 1584 64e81ece3d7e4b24e6c14e37a6047217.exe 19 PID 1584 wrote to memory of 5084 1584 64e81ece3d7e4b24e6c14e37a6047217.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\64e81ece3d7e4b24e6c14e37a6047217.exe"C:\Users\Admin\AppData\Local\Temp\64e81ece3d7e4b24e6c14e37a6047217.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
C:\Users\Admin\AppData\Local\Temp\08wmU7nW53NnlaX.exeC:\Users\Admin\AppData\Local\Temp\08wmU7nW53NnlaX.exe2⤵
- Executes dropped EXE
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178KB
MD56cacfd439a182bb0bce827258b1828f5
SHA1f12394a3ff72e6d98ac1d6651954c0ad161de8ec
SHA2568dcf525971415ba29652d12428aa7fde7c338a1e2a3c752159d03f50edbae94d
SHA51240f9d795342c9f072d07239cea0830b5ccaa46e21ea003a9d2eebcc2e4d3280bcddd108a48460567c79753d2c7f7f8306ce874758d24ee3f57cfb7ce11cb0a62
-
Filesize
67KB
MD550e9d1438f14e3e345db6b9f15473be0
SHA120b511d23f4df169b10d6cd022e90b3441af038a
SHA2566852f4faa2d0ae8be06c198c40875c9ecc466c2da9f6899b6d1f80e7df80b5e9
SHA51265dcd5c3ee197727beef8c5bfef4073d9ed93c6662827721310dcbc0ea02c8334dbe42a47a2aee1cbe35a2943d6518c93a1d77325e58ad74cb93828b6c691ea9
-
Filesize
59KB
MD55efd390d5f95c8191f5ac33c4db4b143
SHA142d81b118815361daa3007f1a40f1576e9a9e0bc
SHA2566028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74
SHA512720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d