Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 19:47

General

  • Target

    9000b78b0179d9d66d117afed1e45f18.exe

  • Size

    717KB

  • MD5

    9000b78b0179d9d66d117afed1e45f18

  • SHA1

    9b801f8f06e054e27511820ecc28648ed536f0f8

  • SHA256

    2321f245a5e01b903075619bcca1aebfc554a9237924ad6c5120370f287e0d5a

  • SHA512

    410dd455ae5796e67b9ae9907c46bd60c6c7cf17470871776e53ca0e233985116eb81b19c8c6c4ec3c3d1f2dc943be231ad4e594b3022c8052652305de4c870c

  • SSDEEP

    12288:UKnekrL58V1Y8OTWE2d3tc+QE5eBykiQFBbfDOpNSpUlzCWRvqk/rnCgPsiy:9LiV28WFyKBePCk/jjkv

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe
    "C:\Users\Admin\AppData\Local\Temp\9000b78b0179d9d66d117afed1e45f18.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe
      "C:\Users\Admin\AppData\Local\Temp/00294823/NEOEM0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops Chrome extension
      • Installs/modifies Browser Helper Object
      • Modifies Internet Explorer settings
      • Modifies registry class
      • System policy modification
      PID:4772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\DoiWnlooad keeper\QUr4L.dll

    Filesize

    222KB

    MD5

    e9b27306a18f18b88945cdf066de2fc9

    SHA1

    4d18490fbb336e261301a967047065dd561cc2f2

    SHA256

    a9880b90d24af3786886306aefe5c79ff3cb2fb7b36ee5fb7bf2af85f240d63c

    SHA512

    f255e8bfb13cfa070b31f47b12a4aacf9ab75a6a8191b6b83740d02c3f007b6d5255a5c2c12bc7b599996742973d2faccb5463d96d16c7aba40e34776823c706

  • C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.dat

    Filesize

    5KB

    MD5

    db47b3f375db127ab32c38236294524f

    SHA1

    3f647b0a0e80bf98be0a68a4e5ee3bbbc3288632

    SHA256

    f40a213f5236b2d76d2f0c03ca2a1ac18a00f210e64792e4de7ae563c3d002c3

    SHA512

    eeb31c9472c709da9df5a292264c3c61873f8d831d0559359819326d898c38c38d88c2fbe9aacb33b09cc5d5c460f8766699b0bdb9eb6b353cbc8420117dc997

  • C:\Users\Admin\AppData\Local\Temp\00294823\NEOEM0.exe

    Filesize

    334KB

    MD5

    8300c91b40229b42301aebc6d8859907

    SHA1

    0b55e56a6add6b4dd4ceff475a0018a203d02a5a

    SHA256

    f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

    SHA512

    0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

  • C:\Users\Admin\AppData\Local\Temp\00294823\QUr4L.tlb

    Filesize

    2KB

    MD5

    39d776f73d1d3f771aaa8c3561367c3a

    SHA1

    eef842aa02927bd7fbe7d569c5446ef1a2ea065f

    SHA256

    c2156787eeb818e587529572599fa124773c71330fb93e1c79f4cb9141090941

    SHA512

    3174095accbf422730e60f61523dec01a9a4519cb4642a641c5f547d530ad41f5386d383b90f7daf34f1f36635775929e99d7fe0030aa24cee30f4de8376eeb3

  • C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\Pky4Sm.js

    Filesize

    5KB

    MD5

    caa80d49e977878a43ad08a10e39814a

    SHA1

    64b62e8b529bc3012305cb7436c575143a4f0448

    SHA256

    aa77efa87427ea25dbd083e56e79420381e0cf814d12cbd0208480cbbb7dc44d

    SHA512

    ec60954d9402ce140bd101ccb817fdc0f2a3f90ad2cd4c5b30dd1c9c5611c8cfae6c9e109678b1d7624704b996fa5445f236f1608a4b8c244643c3df63ea4d1f

  • C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\background.html

    Filesize

    143B

    MD5

    c1a9f2ef1f0b8d61aa775a82322c88a7

    SHA1

    6b51be0cb87cf0b797a8578ee260de89f94f1cc4

    SHA256

    4be01deb1871aa1cf615f89e81a8d7a3495284af4b3b27d8b46ad5a6f2dccd2c

    SHA512

    6e93e2266b5fbeb86e844953171f1c097cf8a3a8207833cb5b156066f6ae26fdab71b9968164c8d20a67985dadc1c0d5e14c565d89413c20a7c24a52da18faea

  • C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\content.js

    Filesize

    197B

    MD5

    5f9891607f65f433b0690bae7088b2c1

    SHA1

    b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

    SHA256

    fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

    SHA512

    76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

  • C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\lsdb.js

    Filesize

    559B

    MD5

    209b7ae0b6d8c3f9687c979d03b08089

    SHA1

    6449f8bff917115eef4e7488fae61942a869200f

    SHA256

    e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

    SHA512

    1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

  • C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\manifest.json

    Filesize

    509B

    MD5

    31084dff5cb37bc3cbbe4ddeacc8f7f1

    SHA1

    f2fb1ee7152c398900132ca50df903029823c477

    SHA256

    39edb1085519fe935c00733c6770037fd84b8da0f4ec46406163c8459325c515

    SHA512

    61b3cda7684524eceff0ee7a9e0a7df6dd51da61a78322619e2bbaa686437d56cfaa650269a6cbc3cd1de3e34f302baa6ae7e38d1cf25239aae7038bf53e186d

  • C:\Users\Admin\AppData\Local\Temp\00294823\ioejhbbloegdmkljhkeadkglapijgklc\sqlite.js

    Filesize

    1KB

    MD5

    e71cd2cdc37a7d0897a7fa3f505f319e

    SHA1

    4481fd87b6ca7d15b15d7e08862585fbbbef528e

    SHA256

    8b0277f2c65a357006c741812a988554989b62d64df60103d74f8283829ed2af

    SHA512

    5cbedceee5d8c70caa81aed31644433124760c6b43ea565bd372a79e95d8d194b291cb78758da5ae385548c0b151f8400756fab028d6affc5b30b0ed814354ff

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dtar83su.Admin\extensions\staged\[email protected]\bootstrap.js

    Filesize

    2KB

    MD5

    1b53c596cfb1aa2209446ff64c17dabd

    SHA1

    2542da14728dcdbe1763f1ee39fe9ceae38ad414

    SHA256

    a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

    SHA512

    be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dtar83su.Admin\extensions\staged\[email protected]\chrome.manifest

    Filesize

    104B

    MD5

    7f067990fd33cb046a2bf0a1d4c99bd8

    SHA1

    2e4750dd26bf1234d53adf75ad391b4128cce751

    SHA256

    a0c96ba1eec1259667813b862754174442f4e03502563e7188b2765d8924365c

    SHA512

    a09786be891cb5c92e94b10cb8dd7ec254a44f180b9b042970730abad880faf1ca57647b7d424340a7c4713027e03f9684ead35e0e676208454bb49d3511e2a2

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dtar83su.Admin\extensions\staged\[email protected]\install.rdf

    Filesize

    609B

    MD5

    6600e9fd5a4d577495e3b245f0277255

    SHA1

    dd4ee36811800e0c610708043caa6aeb4288d089

    SHA256

    262e3d642e9e5afb3d700f52dfa174d7efc25d6578efc4709b67da5369fedb1e

    SHA512

    d0286e7e40deb028d1c837ec16b2afe1140fb487fe9a632c48a8748e00609ecc0474b9736f299a0e455c4e502e8d133f78e8390fcf9f63190676c774df2dd6fb

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g5azq69j.default-release\extensions\staged\[email protected]\content\bg.js

    Filesize

    9KB

    MD5

    ec1c4ac8ed1ff32e6ce6012d81cbf714

    SHA1

    e793a39eedbce0c8af7f54af814f4b358a996419

    SHA256

    6f5c2ae7610dc0455ef651e8730491d4c93c2e9b839abd5f3b21abb73f2b5eec

    SHA512

    5ce1bf98138516f21fff09c9b6020136e2f72c3410c7e63f9952a931732978cf3924553c544d8f71d1ce594944d9d4dc32bc6f923214bc3749bed76dff8382c6