Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2024, 15:15

General

  • Target

    77b26fa384932f38cd7f20f6fb37e1f2.exe

  • Size

    728KB

  • MD5

    77b26fa384932f38cd7f20f6fb37e1f2

  • SHA1

    7d2bc27a902390b981edf9e06721d95c0a47ae62

  • SHA256

    4332bd66303daf9cd0c824ddf292e9628934ca70af827bdacf632a27a0b9cfa9

  • SHA512

    490b0a15df10eafb11ee762118f1591ea989aea16496adf8e7dd7cc40ea5263d8343ee70e4f069751e650e958eae614162b96aa2407683f119d50c6d1fbce6bc

  • SSDEEP

    12288:+42PbHdI7DU4BALWWOrIknMUjnQUW2UKo1nWjhStiSbUccDcIwsrgmr:h2Pbm7FALWWOscni2UKtYcwUccus

Malware Config

Signatures

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • Nirsoft 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe
    "C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe
      /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2488
    • C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe
      /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
      2⤵
      • Accesses Microsoft Outlook accounts
      PID:3392
    • C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe
      /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
      2⤵
        PID:3444
      • C:\Users\Admin\AppData\Local\Temp\77b26fa384932f38cd7f20f6fb37e1f2.exe
        /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1352

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1352-57-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1352-63-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1352-62-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1352-60-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1352-58-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1352-59-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2488-15-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2488-14-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2488-16-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2488-17-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2488-20-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2488-21-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/3392-34-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/3392-32-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/3392-29-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/3392-35-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/3392-30-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/3392-31-0x0000000000400000-0x0000000000419000-memory.dmp

      Filesize

      100KB

    • memory/3444-49-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/3444-46-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/3444-48-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/3444-45-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/3444-44-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/3444-43-0x0000000000400000-0x0000000000418000-memory.dmp

      Filesize

      96KB

    • memory/5072-2-0x0000000000C30000-0x0000000000C57000-memory.dmp

      Filesize

      156KB

    • memory/5072-18-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/5072-8-0x0000000000510000-0x000000000051A000-memory.dmp

      Filesize

      40KB

    • memory/5072-3-0x0000000010000000-0x000000001003E000-memory.dmp

      Filesize

      248KB

    • memory/5072-67-0x0000000010000000-0x000000001001F000-memory.dmp

      Filesize

      124KB

    • memory/5072-65-0x0000000010000000-0x000000001001F000-memory.dmp

      Filesize

      124KB

    • memory/5072-69-0x0000000010000000-0x000000001001F000-memory.dmp

      Filesize

      124KB