Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 08:50
Behavioral task
behavioral1
Sample
ab7cd8fa28142b0dc7a04eb54900fed3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ab7cd8fa28142b0dc7a04eb54900fed3.exe
Resource
win10v2004-20240226-en
General
-
Target
ab7cd8fa28142b0dc7a04eb54900fed3.exe
-
Size
1.1MB
-
MD5
ab7cd8fa28142b0dc7a04eb54900fed3
-
SHA1
b7b2037e9f0141a0e9628d60cc2344e0e6a5c905
-
SHA256
612882f1d59d610ed6ebdbc5b4d71d256e3857d0faf91d802fbc4b60d64edb52
-
SHA512
fa2bcb6157eb8e3413da2b9c6617d2e1759bb0dfecdf2fd1728f255449384618e4e7f3cf78377513a99e903bb1924ce365448697a8835c2b73b34db3a559783f
-
SSDEEP
24576:h3+USWqrLV4R9W1zqiChJfRAONeT61t0WnW1s/wfIuyzjbtBhqM7VbwE2wUr4aLj:h3+sqVBWJ/vNeT6vQsQ43RqMxF2B+ed
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3284 emICTLmO5c7RWkq.exe 1164 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/844-0-0x0000000000D90000-0x0000000000DA7000-memory.dmp upx behavioral2/memory/1164-8-0x0000000000400000-0x0000000000417000-memory.dmp upx behavioral2/files/0x0008000000023308-7.dat upx behavioral2/memory/844-9-0x0000000000D90000-0x0000000000DA7000-memory.dmp upx behavioral2/files/0x000300000002270b-12.dat upx behavioral2/memory/1164-174-0x0000000000400000-0x0000000000417000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" ab7cd8fa28142b0dc7a04eb54900fed3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_sl.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_zh-CN.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\psmachine.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\psuser_64.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_gu.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_ru.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_ml.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_te.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_de.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_el.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_kn.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_lv.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\GoogleUpdateWebPlugin.exe emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\psmachine_64.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_et.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_uk.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_es-419.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_ta.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_th.dll emICTLmO5c7RWkq.exe File opened for modification C:\Program Files (x86)\GUMB844.tmp\GoogleUpdateSetup.exe emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\GoogleUpdateComRegisterShell64.exe emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_am.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_da.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_en-GB.dll emICTLmO5c7RWkq.exe File opened for modification C:\Program Files (x86)\GUTB845.tmp emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\GoogleCrashHandler.exe emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_hu.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_pt-PT.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_ur.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_sr.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdate.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\psuser.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_fi.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_hi.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_cs.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_hr.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_mr.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_sw.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_ja.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_no.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_iw.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_sv.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\npGoogleUpdate3.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_bn.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_en.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_es.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_id.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_ms.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\GoogleUpdate.exe emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\GoogleUpdateHelper.msi emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\GoogleUpdateOnDemand.exe emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_fr.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\GoogleCrashHandler64.exe emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\GoogleUpdateCore.exe emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_lt.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_fa.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_nl.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_ro.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_bg.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_ca.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_pl.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_tr.dll emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\GoogleUpdateBroker.exe emICTLmO5c7RWkq.exe File created C:\Program Files (x86)\GUMB844.tmp\goopdateres_ar.dll emICTLmO5c7RWkq.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe ab7cd8fa28142b0dc7a04eb54900fed3.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 844 ab7cd8fa28142b0dc7a04eb54900fed3.exe Token: SeDebugPrivilege 1164 CTS.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 844 wrote to memory of 3284 844 ab7cd8fa28142b0dc7a04eb54900fed3.exe 93 PID 844 wrote to memory of 3284 844 ab7cd8fa28142b0dc7a04eb54900fed3.exe 93 PID 844 wrote to memory of 3284 844 ab7cd8fa28142b0dc7a04eb54900fed3.exe 93 PID 844 wrote to memory of 1164 844 ab7cd8fa28142b0dc7a04eb54900fed3.exe 94 PID 844 wrote to memory of 1164 844 ab7cd8fa28142b0dc7a04eb54900fed3.exe 94 PID 844 wrote to memory of 1164 844 ab7cd8fa28142b0dc7a04eb54900fed3.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab7cd8fa28142b0dc7a04eb54900fed3.exe"C:\Users\Admin\AppData\Local\Temp\ab7cd8fa28142b0dc7a04eb54900fed3.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\emICTLmO5c7RWkq.exeC:\Users\Admin\AppData\Local\Temp\emICTLmO5c7RWkq.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3284
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:81⤵PID:3408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5d4890c2e5a0091776edf5d6b8736226d
SHA10b3e8ac56a99d82e256c51ed68be279598c1b1cc
SHA2565d65d5eaf55d1f51b7310dbf97a7ce9b476410b6384975862117b979991186fd
SHA51282fea4e87e06384c50c5eee549a31cf4bc5776fa830b01663a10e1db60b5c049627ad28404ea240307cf57912b35d547cc35652293b452497c6e40aaa963d751
-
Filesize
1.1MB
MD553baee50f7a69bf3bc0fffe25341a923
SHA10b7998f5517ed4e7c5aeea3a89d73b60d2a2d102
SHA256f91e258ea71dcbfc82371b2ee3e20852e45bef0cb946223d1141a6ef1dfb793f
SHA5120eb28032849f775f604b7064a4f00f7d802c8c2fd5c7bc21b48298e6c3d316286963794b4c6c4981199c21f56b08d9aa466a470d40738d1b633b7feddc8e6241
-
Filesize
59KB
MD55efd390d5f95c8191f5ac33c4db4b143
SHA142d81b118815361daa3007f1a40f1576e9a9e0bc
SHA2566028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74
SHA512720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d