Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 20:27
Behavioral task
behavioral1
Sample
75706464b91635ce44a02c121de61c3d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
75706464b91635ce44a02c121de61c3d.exe
Resource
win10v2004-20231215-en
General
-
Target
75706464b91635ce44a02c121de61c3d.exe
-
Size
46KB
-
MD5
75706464b91635ce44a02c121de61c3d
-
SHA1
23d5fdfe8f0ccbcbc37654b5677ae12d409bfd5e
-
SHA256
a406b3a2ef6709e23aa0c124935dac8c089d980f17d8b1fd83e4f4e9ccab7950
-
SHA512
891397de1d697f2f4aa6f04de330b07f1e8ef836040d6b707ad9d6a6954db4b9163ba59dc559b2312ecb9becafe84f89768662d0ba8dfa3d2717057e98467e0c
-
SSDEEP
768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFjFPEmpoCl0ziyHcDq2L:SKcR4mjD9r823FemKCmiy8Dq2gZhs
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3428 xYZO9Hmb2EMiKCK.exe 4812 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/1660-0-0x0000000000590000-0x00000000005A7000-memory.dmp upx behavioral2/files/0x0007000000023205-6.dat upx behavioral2/memory/1660-7-0x0000000000590000-0x00000000005A7000-memory.dmp upx behavioral2/memory/4812-9-0x0000000000560000-0x0000000000577000-memory.dmp upx behavioral2/files/0x000a00000002304d-13.dat upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 75706464b91635ce44a02c121de61c3d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 75706464b91635ce44a02c121de61c3d.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1660 75706464b91635ce44a02c121de61c3d.exe Token: SeDebugPrivilege 4812 CTS.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1660 wrote to memory of 3428 1660 75706464b91635ce44a02c121de61c3d.exe 86 PID 1660 wrote to memory of 3428 1660 75706464b91635ce44a02c121de61c3d.exe 86 PID 1660 wrote to memory of 4812 1660 75706464b91635ce44a02c121de61c3d.exe 88 PID 1660 wrote to memory of 4812 1660 75706464b91635ce44a02c121de61c3d.exe 88 PID 1660 wrote to memory of 4812 1660 75706464b91635ce44a02c121de61c3d.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\75706464b91635ce44a02c121de61c3d.exe"C:\Users\Admin\AppData\Local\Temp\75706464b91635ce44a02c121de61c3d.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\xYZO9Hmb2EMiKCK.exeC:\Users\Admin\AppData\Local\Temp\xYZO9Hmb2EMiKCK.exe2⤵
- Executes dropped EXE
PID:3428
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
MD52fa3999ac1b0154e2fd68a12721b5172
SHA1a907c170efd1dff8efa7e1394b35b75b686f9680
SHA256285bdf3971521310abd38e4c7ae75802ff94c3da7137f3ee02c24a6623c8641d
SHA512c2f5ac490d146d39130a1e0a3802d28fd58ec2aadb8badcbed464d7cf444c11acc559bfc2629ec2528ce04cfe05071957fb635fd7be8e5b8d4bb7d8ee0338400
-
Filesize
16KB
MD595c9a037d3b01a21275aa6cc73b122a2
SHA1c19ed8afc95b91d0cc6bc075047de30eae015386
SHA2561d5edcbae3258efb07cc57ba8d7cd1ebe2eb5106ef1a894b787ed2857952c523
SHA512761bb76261712a597f610e3162fa1514d2f56d69d03d1b76b51c6b2a7b0c88bbd385b7dc849c6913f7d861fb3aed8551f26f640d90b621e8629abe2e4bfb6160
-
Filesize
29KB
MD570aa23c9229741a9b52e5ce388a883ac
SHA1b42683e21e13de3f71db26635954d992ebe7119e
SHA2569d25cc704b1c00c9d17903e25ca35c319663e997cb9da0b116790b639e9688f2
SHA512be604a2ad5ab8a3e5edb8901016a76042ba873c8d05b4ef8eec31241377ec6b2a883b51c6912dc7640581ffa624547db334683975883ae74e62808b5ae9ab0b5