Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 04:45
Behavioral task
behavioral1
Sample
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
General
-
Target
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe
-
Size
4.2MB
-
MD5
c9a36a7e0bf431dafe139b1cc18609ed
-
SHA1
4d77f0d31e994d3baeba164238634cadaf95fb77
-
SHA256
7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3
-
SHA512
1cdc8cf07dc0b3d83d5f07e1de8bc60a9b5f0f568087f0cc740cc64492eb609e171c4f93eaad37abd9e4f018ed7983f2cdfe991309f6797572d9ee45fa0b8b96
-
SSDEEP
98304:6PSzwcdHYUcyX4eHU0hU/cSuijBf1ULKPQ1w9VOO6GQgjIkU:WS0cJ59U0hUkx6f1g1w9CGQ2I
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/4492-0-0x00007FF7AAAE0000-0x00007FF7AB758000-memory.dmp UPX behavioral2/memory/4492-16-0x00007FF7AAAE0000-0x00007FF7AB758000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/4492-0-0x00007FF7AAAE0000-0x00007FF7AB758000-memory.dmp upx behavioral2/memory/4492-16-0x00007FF7AAAE0000-0x00007FF7AB758000-memory.dmp upx -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 ipinfo.io -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3864 wmic.exe -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 10 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe Token: SeIncreaseQuotaPrivilege 4384 wmic.exe Token: SeSecurityPrivilege 4384 wmic.exe Token: SeTakeOwnershipPrivilege 4384 wmic.exe Token: SeLoadDriverPrivilege 4384 wmic.exe Token: SeSystemProfilePrivilege 4384 wmic.exe Token: SeSystemtimePrivilege 4384 wmic.exe Token: SeProfSingleProcessPrivilege 4384 wmic.exe Token: SeIncBasePriorityPrivilege 4384 wmic.exe Token: SeCreatePagefilePrivilege 4384 wmic.exe Token: SeBackupPrivilege 4384 wmic.exe Token: SeRestorePrivilege 4384 wmic.exe Token: SeShutdownPrivilege 4384 wmic.exe Token: SeDebugPrivilege 4384 wmic.exe Token: SeSystemEnvironmentPrivilege 4384 wmic.exe Token: SeRemoteShutdownPrivilege 4384 wmic.exe Token: SeUndockPrivilege 4384 wmic.exe Token: SeManageVolumePrivilege 4384 wmic.exe Token: 33 4384 wmic.exe Token: 34 4384 wmic.exe Token: 35 4384 wmic.exe Token: 36 4384 wmic.exe Token: SeIncreaseQuotaPrivilege 4384 wmic.exe Token: SeSecurityPrivilege 4384 wmic.exe Token: SeTakeOwnershipPrivilege 4384 wmic.exe Token: SeLoadDriverPrivilege 4384 wmic.exe Token: SeSystemProfilePrivilege 4384 wmic.exe Token: SeSystemtimePrivilege 4384 wmic.exe Token: SeProfSingleProcessPrivilege 4384 wmic.exe Token: SeIncBasePriorityPrivilege 4384 wmic.exe Token: SeCreatePagefilePrivilege 4384 wmic.exe Token: SeBackupPrivilege 4384 wmic.exe Token: SeRestorePrivilege 4384 wmic.exe Token: SeShutdownPrivilege 4384 wmic.exe Token: SeDebugPrivilege 4384 wmic.exe Token: SeSystemEnvironmentPrivilege 4384 wmic.exe Token: SeRemoteShutdownPrivilege 4384 wmic.exe Token: SeUndockPrivilege 4384 wmic.exe Token: SeManageVolumePrivilege 4384 wmic.exe Token: 33 4384 wmic.exe Token: 34 4384 wmic.exe Token: 35 4384 wmic.exe Token: 36 4384 wmic.exe Token: SeIncreaseQuotaPrivilege 3864 wmic.exe Token: SeSecurityPrivilege 3864 wmic.exe Token: SeTakeOwnershipPrivilege 3864 wmic.exe Token: SeLoadDriverPrivilege 3864 wmic.exe Token: SeSystemProfilePrivilege 3864 wmic.exe Token: SeSystemtimePrivilege 3864 wmic.exe Token: SeProfSingleProcessPrivilege 3864 wmic.exe Token: SeIncBasePriorityPrivilege 3864 wmic.exe Token: SeCreatePagefilePrivilege 3864 wmic.exe Token: SeBackupPrivilege 3864 wmic.exe Token: SeRestorePrivilege 3864 wmic.exe Token: SeShutdownPrivilege 3864 wmic.exe Token: SeDebugPrivilege 3864 wmic.exe Token: SeSystemEnvironmentPrivilege 3864 wmic.exe Token: SeRemoteShutdownPrivilege 3864 wmic.exe Token: SeUndockPrivilege 3864 wmic.exe Token: SeManageVolumePrivilege 3864 wmic.exe Token: 33 3864 wmic.exe Token: 34 3864 wmic.exe Token: 35 3864 wmic.exe Token: 36 3864 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4492 wrote to memory of 4384 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 85 PID 4492 wrote to memory of 4384 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 85 PID 4492 wrote to memory of 3864 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 87 PID 4492 wrote to memory of 3864 4492 7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe"C:\Users\Admin\AppData\Local\Temp\7e33dd313ed09a15c81af55ee0997031caa3da8fba8c31c3859bc95e52559ff3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\System32\Wbem\wmic.exewmic cpu get name2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4384
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:3864
-