Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2024, 07:20
Behavioral task
behavioral1
Sample
86476884d5cf831c852593bb8f9cc597.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
86476884d5cf831c852593bb8f9cc597.exe
Resource
win10v2004-20231215-en
General
-
Target
86476884d5cf831c852593bb8f9cc597.exe
-
Size
41KB
-
MD5
86476884d5cf831c852593bb8f9cc597
-
SHA1
a70de34904c55e7c2f08d5e154406b1bf0d25d5d
-
SHA256
e717ddb6adfb9a8f1cd374a38f10cacd29c169727329a2be11ca086da88b75c0
-
SHA512
9cb18391c316a6bc350219906cea540b8e543951ec9423157279fded2977bdc527d9dfa3da903e88d034c96408dde2813c9691c5f27e40efc8baa20a0d07ce3a
-
SSDEEP
768:X8Q2ZDX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIom46+I7cVKh:s9Z3KcR4mjD9r8226+Eh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 896 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4236-0-0x0000000000C30000-0x0000000000C47000-memory.dmp upx behavioral2/memory/896-9-0x00000000006D0000-0x00000000006E7000-memory.dmp upx behavioral2/files/0x0006000000023207-8.dat upx behavioral2/files/0x0009000000023056-12.dat upx behavioral2/memory/4236-7-0x0000000000C30000-0x0000000000C47000-memory.dmp upx behavioral2/files/0x0008000000023202-30.dat upx behavioral2/memory/896-32-0x00000000006D0000-0x00000000006E7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 86476884d5cf831c852593bb8f9cc597.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe 86476884d5cf831c852593bb8f9cc597.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4236 86476884d5cf831c852593bb8f9cc597.exe Token: SeDebugPrivilege 896 CTS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4236 wrote to memory of 896 4236 86476884d5cf831c852593bb8f9cc597.exe 20 PID 4236 wrote to memory of 896 4236 86476884d5cf831c852593bb8f9cc597.exe 20 PID 4236 wrote to memory of 896 4236 86476884d5cf831c852593bb8f9cc597.exe 20
Processes
-
C:\Users\Admin\AppData\Local\Temp\86476884d5cf831c852593bb8f9cc597.exe"C:\Users\Admin\AppData\Local\Temp\86476884d5cf831c852593bb8f9cc597.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:896
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5ee3cbd14785a1f73666933ba27fb2c7c
SHA11fc1209ae00bd92167649701b879ddee97d567e2
SHA25644a3ca309cb2b2731735aff0ceca19eabebbdfbb0f92428d8871c50c82f3380b
SHA51218860b265fb3d527e382c436a4008e51b6b0e3c70b85c286f0643aac836bac255782104f10316dd48a4ed2771af772567b112fda969e706e027e2196429faa6b
-
Filesize
41KB
MD58a64c97624ac86aa23cc0fdea55383a8
SHA16fb041bfad8d0464d60c07730a9cfab9312b70a9
SHA25645ee6d78f141e69c54a5af74186436927284472b95a19329ff853ba37f9b3d1d
SHA5127aead4b6b5115825448e17ecd04ebcafb9dca57565b5f0391e652682d8477789a22252603e567dfd12e57803a9b5a0bd7d660026f61dddbd4f089c5bff93d70e
-
Filesize
35KB
MD593e5f18caebd8d4a2c893e40e5f38232
SHA1fd55c4e6bcd108bce60ea719c06dc9c4d0adafa6
SHA256a66c4b98becac2f69cb107cd087d7a2ca9ef511bc3b83367b1f440f11dd159a8
SHA512986583610d27caae2080834301d072557c5d2c85e33f0d19ab1245d7eae8db146397461572ddb3d491be16f3af210720d54267dac838fdad8fe34afa3d6b7f54