Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 15:15

General

  • Target

    77b26fa384932f38cd7f20f6fb37e1f2.exe

  • Size

    728KB

  • MD5

    77b26fa384932f38cd7f20f6fb37e1f2

  • SHA1

    7d2bc27a902390b981edf9e06721d95c0a47ae62

  • SHA256

    4332bd66303daf9cd0c824ddf292e9628934ca70af827bdacf632a27a0b9cfa9

  • SHA512

    490b0a15df10eafb11ee762118f1591ea989aea16496adf8e7dd7cc40ea5263d8343ee70e4f069751e650e958eae614162b96aa2407683f119d50c6d1fbce6bc

  • SSDEEP

    12288:+42PbHdI7DU4BALWWOrIknMUjnQUW2UKo1nWjhStiSbUccDcIwsrgmr:h2Pbm7FALWWOscni2UKtYcwUccus

Malware Config

Signatures

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • Nirsoft 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe
    "C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe
      /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2664
    • C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe
      /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
      2⤵
      • Accesses Microsoft Outlook accounts
      PID:2800
    • C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe
      /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
      2⤵
        PID:2572
      • C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe
        /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1184

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1768-2-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/1768-7-0x00000000001C0000-0x00000000001CA000-memory.dmp

      Filesize

      40KB

    • memory/1768-115-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/2572-65-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/2572-63-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/2664-31-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2664-17-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2664-26-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2664-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2664-30-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2664-20-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2664-13-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2664-23-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2664-15-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2800-49-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/2800-41-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/2800-39-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/2800-56-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/2800-43-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/2800-46-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/2800-52-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB