Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    23/01/2024, 15:56

General

  • Target

    TankuumSetup.exe

  • Size

    140.1MB

  • MD5

    d34b73aed1fda7213774fc21abc71fb4

  • SHA1

    68c7fe89033a29a67808e6fadb241fa202265ae9

  • SHA256

    1b638d5797c7091be2404509fa9933cfb24a01b40ad74626193d277e234057ad

  • SHA512

    5b83eec2f885f2b4dc7dc456eeb3b9d8076462c100c244add1fbb9d21df08243d1f49ad813371afb1a5285af8391127f7505846a979543149a7f70c4bcd0ade0

  • SSDEEP

    1572864:A2Cm7gJKfVjsPawuFHNwczWTeMkF7ZEk8bCkKbj:XaodJFek8+k

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TankuumSetup is a game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1208 --field-trial-handle=1296,i,11551207518545667720,10278222362127485555,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2828
      • C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\TankuumSetup is a game" --mojo-platform-channel-handle=1380 --field-trial-handle=1296,i,11551207518545667720,10278222362127485555,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:2408
        • C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe
          "C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\TankuumSetup is a game" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1532 --field-trial-handle=1296,i,11551207518545667720,10278222362127485555,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Checks computer location settings
          PID:2572
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
          2⤵
            PID:2564
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2012
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
            2⤵
              PID:2144
              • C:\Windows\system32\reg.exe
                C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
                3⤵
                  PID:1928
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
                2⤵
                  PID:1476
                  • C:\Windows\system32\reg.exe
                    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
                    3⤵
                      PID:2540
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                    2⤵
                      PID:1736
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic path win32_VideoController get name
                        3⤵
                        • Detects videocard installed
                        • Suspicious use of AdjustPrivilegeToken
                        PID:768
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
                      2⤵
                        PID:2284
                        • C:\Windows\system32\cmd.exe
                          cmd /c chcp 65001
                          3⤵
                            PID:2160
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              4⤵
                                PID:2376
                            • C:\Windows\system32\netsh.exe
                              netsh wlan show profiles
                              3⤵
                                PID:2216
                            • C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe
                              "C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TankuumSetup is a game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1296,i,11551207518545667720,10278222362127485555,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                              2⤵
                                PID:988
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"
                                2⤵
                                  PID:2100
                                  • C:\Windows\system32\reg.exe
                                    C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f
                                    3⤵
                                    • Adds Run key to start application
                                    PID:1632
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                  2⤵
                                    PID:392
                                    • C:\Windows\system32\tasklist.exe
                                      tasklist
                                      3⤵
                                      • Enumerates processes with tasklist
                                      PID:2204
                                  • C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe
                                    "C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TankuumSetup is a game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1296,i,11551207518545667720,10278222362127485555,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                    2⤵
                                      PID:2816
                                    • C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe
                                      "C:\Users\Admin\AppData\Local\Temp\TankuumSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\TankuumSetup is a game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2296 --field-trial-handle=1296,i,11551207518545667720,10278222362127485555,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                      2⤵
                                        PID:1528

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

                                      Filesize

                                      249B

                                      MD5

                                      cf7e4a12f932a3fddddacc8b10e1f1b0

                                      SHA1

                                      db6f9bc2be5e0905086b7b7b07109ef8d67b24ee

                                      SHA256

                                      1b6d3f6ad849e115bf20175985bed9bcfc6ec206e288b97ac14c3a23b5d28a4b

                                      SHA512

                                      fab79f26c1841310cc61e2f8336ca05281a9252a34a3c240e500c8775840374edb0a42094c64aa38a29ca79e1cafa114d6f1bbe3009060d32f8c1df9f088c12c

                                    • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt

                                      Filesize

                                      231B

                                      MD5

                                      dec2be4f1ec3592cea668aa279e7cc9b

                                      SHA1

                                      327cf8ab0c895e10674e00ea7f437784bb11d718

                                      SHA256

                                      753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

                                      SHA512

                                      81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

                                    • C:\Users\Admin\AppData\Roaming\TankuumSetup is a game\Local Storage\leveldb\CURRENT~RFf76892d.TMP

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • \Users\Admin\AppData\Local\Temp\c9c58135-3880-4beb-a5fb-f556a137f119.tmp.node

                                      Filesize

                                      641KB

                                      MD5

                                      73771feea598b6bbeb3ca4aa05f8042e

                                      SHA1

                                      442e20097c660a8c911b24522c6826a043ff25b4

                                      SHA256

                                      07e3c56c257c03dcad4c32dc14215a4180b598a3cef956114731e6d4dd5db4d1

                                      SHA512

                                      755f27a9aeeb1ef964a5d92f5a4d66325dd3d6e7547df6e39db42a3bc8ac30c12b0325e698b2110216be37cd8bea9bc33f11ef1061e0a700909197aeb100dd08

                                    • \Users\Admin\AppData\Local\Temp\eda14cb9-fae4-4bc8-9888-d136fbbbfeb4.tmp.node

                                      Filesize

                                      2.7MB

                                      MD5

                                      34338c8a774bc30c223f228b3ef394bb

                                      SHA1

                                      98ae6592b53d35261b1a122d5b60bea7a8d8fb96

                                      SHA256

                                      d868ca7a24ce77b9ed0d78ce2e75e85f7c342888def0b8d65a9a965b81d3e1ab

                                      SHA512

                                      b728b18adc32111c53210282dae660fea7bab66e6dee4ae62f8761e5e8cb1ff4db3420a04d861a60949221d8611b0fa0d02d4963ae1a3d338d0f7f4af20a90f7

                                    • memory/1768-19-0x0000000002B50000-0x0000000002B51000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2828-5-0x0000000000060000-0x0000000000061000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2828-50-0x0000000076F50000-0x0000000076F51000-memory.dmp

                                      Filesize

                                      4KB