Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2024, 06:32

General

  • Target

    7f2330def39913a8dfa6252f81637197.exe

  • Size

    249KB

  • MD5

    7f2330def39913a8dfa6252f81637197

  • SHA1

    5f4e7714e7a278ad5279a62f1b352e80252c934d

  • SHA256

    9de7bad6c008475fc6b83764c55296f7e45a32342c445c46ce3e384737ad30fe

  • SHA512

    e26e44875fcb4d963b44352abacb537cd2df9a3feeffe03521b0e6858287d98e8c1c48f377bf5ed314e062c6b7a89f3c5b5932e41f57601dbae8e69988b1cb47

  • SSDEEP

    6144:IM0Ky/jFZofhxOeqKlusmJTZVDcgR2Ge0Uxe955WMenawoS:IM0KybFZShMeqqufpXDJQGexGjHwoS

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f2330def39913a8dfa6252f81637197.exe
    "C:\Users\Admin\AppData\Local\Temp\7f2330def39913a8dfa6252f81637197.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Users\Admin\AppData\Local\Temp\7f2330def39913a8dfa6252f81637197.exe
      C:\Users\Admin\AppData\Local\Temp\7f2330def39913a8dfa6252f81637197.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Recycle.Bin\Recycle.Bin.exe
        "C:\Recycle.Bin\Recycle.Bin.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3232
        • C:\Recycle.Bin\Recycle.Bin.exe
          C:\Recycle.Bin\Recycle.Bin.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4100
          • C:\Users\Admin\AppData\Local\Temp\3XA92CA.exe
            "C:\Users\Admin\AppData\Local\Temp\3XA92CA.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Recycle.Bin\Recycle.Bin.exe

    Filesize

    249KB

    MD5

    7f2330def39913a8dfa6252f81637197

    SHA1

    5f4e7714e7a278ad5279a62f1b352e80252c934d

    SHA256

    9de7bad6c008475fc6b83764c55296f7e45a32342c445c46ce3e384737ad30fe

    SHA512

    e26e44875fcb4d963b44352abacb537cd2df9a3feeffe03521b0e6858287d98e8c1c48f377bf5ed314e062c6b7a89f3c5b5932e41f57601dbae8e69988b1cb47

  • C:\Recycle.Bin\config.bin

    Filesize

    4KB

    MD5

    649ff12ebf081a1e7f3a283753b82a1b

    SHA1

    c79757cfa811a1d27a7bae0c3f366c779aab457a

    SHA256

    311da4bc1cd00e3d85994738b84171ca59d69ff70fea4c8e94d831199d2a4097

    SHA512

    61b27d2d184efe36765eb1a303dcd19ec6395b748b06ce9d43cb547fd5842e2f26839821a8851b56083192f5aed6827deeaeedd80cd9315476042283d120ac73

  • C:\Users\Admin\AppData\Local\Temp\3XA92CA.exe

    Filesize

    3KB

    MD5

    29090b6b4d6605a97ac760d06436ac2d

    SHA1

    d929d3389642e52bae5ad8512293c9c4d3e4fab5

    SHA256

    98a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272

    SHA512

    9121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be

  • memory/1776-7-0x0000000000400000-0x0000000000752000-memory.dmp

    Filesize

    3.3MB

  • memory/1776-0-0x0000000000400000-0x0000000000752000-memory.dmp

    Filesize

    3.3MB

  • memory/2516-131-0x0000000074FF0000-0x0000000075440000-memory.dmp

    Filesize

    4.3MB

  • memory/2516-9-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2516-10-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2516-15-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2516-14-0x0000000000960000-0x0000000000A50000-memory.dmp

    Filesize

    960KB

  • memory/2516-13-0x00000000004A0000-0x00000000004A1000-memory.dmp

    Filesize

    4KB

  • memory/2516-16-0x0000000000960000-0x0000000000A60000-memory.dmp

    Filesize

    1024KB

  • memory/2516-18-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/2516-17-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/2516-23-0x00000000004A0000-0x00000000004A2000-memory.dmp

    Filesize

    8KB

  • memory/2516-20-0x0000000077692000-0x0000000077694000-memory.dmp

    Filesize

    8KB

  • memory/2516-11-0x0000000000960000-0x0000000000A50000-memory.dmp

    Filesize

    960KB

  • memory/2516-87-0x00000000004C0000-0x00000000004C1000-memory.dmp

    Filesize

    4KB

  • memory/2516-37-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2516-3-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2516-98-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2516-103-0x0000000077692000-0x0000000077694000-memory.dmp

    Filesize

    8KB

  • memory/2516-82-0x00000000004C0000-0x00000000004C1000-memory.dmp

    Filesize

    4KB

  • memory/2516-46-0x0000000000960000-0x0000000000A50000-memory.dmp

    Filesize

    960KB

  • memory/2516-43-0x0000000000960000-0x0000000000A50000-memory.dmp

    Filesize

    960KB

  • memory/2516-107-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2516-12-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2516-115-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2516-92-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2516-96-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2516-101-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2516-55-0x00000000004A0000-0x00000000004A1000-memory.dmp

    Filesize

    4KB

  • memory/2516-110-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2516-70-0x0000000077692000-0x0000000077694000-memory.dmp

    Filesize

    8KB

  • memory/2516-6-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/2516-104-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2516-63-0x0000000000960000-0x0000000000A60000-memory.dmp

    Filesize

    1024KB

  • memory/2516-113-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2516-116-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/2516-112-0x0000000077692000-0x0000000077694000-memory.dmp

    Filesize

    8KB

  • memory/3232-33-0x0000000000400000-0x0000000000752000-memory.dmp

    Filesize

    3.3MB

  • memory/4100-50-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/4100-53-0x0000000002240000-0x0000000002330000-memory.dmp

    Filesize

    960KB

  • memory/4100-48-0x00000000008C0000-0x000000000090D000-memory.dmp

    Filesize

    308KB

  • memory/4100-39-0x00000000004A0000-0x00000000004A1000-memory.dmp

    Filesize

    4KB

  • memory/4100-38-0x00000000008C0000-0x000000000090D000-memory.dmp

    Filesize

    308KB

  • memory/4100-36-0x0000000000400000-0x0000000000460000-memory.dmp

    Filesize

    384KB

  • memory/4820-95-0x0000000002AE0000-0x0000000002F30000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-76-0x0000000002AE0000-0x0000000002F30000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-86-0x0000000074FF0000-0x0000000075440000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-85-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-83-0x0000000074FF0000-0x0000000075440000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-90-0x0000000074FF0000-0x0000000075440000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-94-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-89-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-80-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-75-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-97-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-73-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-102-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-71-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-68-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-69-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-66-0x00000000008C0000-0x000000000090D000-memory.dmp

    Filesize

    308KB

  • memory/4820-62-0x00000000008C0000-0x000000000090D000-memory.dmp

    Filesize

    308KB

  • memory/4820-114-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-111-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-108-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-109-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-60-0x00000000008C0000-0x000000000090D000-memory.dmp

    Filesize

    308KB

  • memory/4820-106-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-56-0x00000000008C0000-0x000000000090D000-memory.dmp

    Filesize

    308KB

  • memory/4820-99-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-100-0x0000000074FF0000-0x0000000075440000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-58-0x00000000008C0000-0x000000000090D000-memory.dmp

    Filesize

    308KB

  • memory/4820-93-0x0000000074FF0000-0x0000000075440000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-57-0x0000000001000000-0x0000000001004000-memory.dmp

    Filesize

    16KB

  • memory/4820-84-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-79-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-78-0x0000000077692000-0x0000000077694000-memory.dmp

    Filesize

    8KB

  • memory/4820-81-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-77-0x0000000077694000-0x0000000077696000-memory.dmp

    Filesize

    8KB

  • memory/4820-74-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-72-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-64-0x00000000008A0000-0x00000000008A5000-memory.dmp

    Filesize

    20KB

  • memory/4820-54-0x00000000008C0000-0x000000000090D000-memory.dmp

    Filesize

    308KB

  • memory/4820-118-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-129-0x0000000076730000-0x0000000076793000-memory.dmp

    Filesize

    396KB

  • memory/4820-132-0x0000000074FF0000-0x0000000075440000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-45-0x00000000008C0000-0x000000000090D000-memory.dmp

    Filesize

    308KB

  • memory/4820-136-0x0000000002AE0000-0x0000000002B20000-memory.dmp

    Filesize

    256KB

  • memory/4820-137-0x0000000074FF0000-0x0000000075440000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-135-0x0000000074FF0000-0x0000000075440000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-138-0x0000000002AE0000-0x0000000002B20000-memory.dmp

    Filesize

    256KB

  • memory/4820-139-0x00000000031F0000-0x0000000003640000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-140-0x00000000031F0000-0x0000000003640000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-141-0x0000000074FF0000-0x0000000075440000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-143-0x00000000031F0000-0x0000000003640000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-145-0x0000000002AE0000-0x0000000002B20000-memory.dmp

    Filesize

    256KB

  • memory/4820-144-0x0000000002BE0000-0x0000000002C43000-memory.dmp

    Filesize

    396KB

  • memory/4820-142-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-146-0x00000000031F0000-0x0000000003640000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-147-0x00000000031F0000-0x0000000003640000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-148-0x00000000031F0000-0x0000000003640000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-149-0x00000000031F0000-0x0000000003640000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-150-0x00000000031F0000-0x0000000003640000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-151-0x00000000008C0000-0x000000000090D000-memory.dmp

    Filesize

    308KB

  • memory/4820-152-0x00000000008A0000-0x00000000008A5000-memory.dmp

    Filesize

    20KB

  • memory/4820-153-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-158-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB

  • memory/4820-159-0x0000000076730000-0x0000000076793000-memory.dmp

    Filesize

    396KB

  • memory/4820-160-0x0000000002AE0000-0x0000000002B20000-memory.dmp

    Filesize

    256KB

  • memory/4820-161-0x00000000031F0000-0x0000000003640000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-163-0x00000000031F0000-0x0000000003640000-memory.dmp

    Filesize

    4.3MB

  • memory/4820-164-0x000000000BAD0000-0x000000000BB1D000-memory.dmp

    Filesize

    308KB