Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/03/2024, 14:02
Behavioral task
behavioral1
Sample
b24f3629767e95aa88e064dbe3480f9a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b24f3629767e95aa88e064dbe3480f9a.exe
Resource
win10v2004-20240226-en
General
-
Target
b24f3629767e95aa88e064dbe3480f9a.exe
-
Size
52KB
-
MD5
b24f3629767e95aa88e064dbe3480f9a
-
SHA1
6d3670b669317a1b8b1e1ac55f86f1526a9424c8
-
SHA256
e920922b09518fb34a15c2dcb673c66a1034de0463f5400270da6dfeab381202
-
SHA512
5bf398fa9f96a756befc1a2faf60e2a7c1888410d6e9fe6ad7467b63d4b231d03bcfb93e101cba6e0762799aa6770a4993edd32dd5260d450dbf92fb7bd45103
-
SSDEEP
768:X8Q2ZDX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIom46+IsRF9fFoFict+kRaXP:s9Z3KcR4mjD9r8226+3RFFFoFNtD78kq
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2956 53bTumaGm3J5GNT.exe 2124 CTS.exe -
Loads dropped DLL 3 IoCs
pid Process 2120 b24f3629767e95aa88e064dbe3480f9a.exe 2120 b24f3629767e95aa88e064dbe3480f9a.exe 1988 Process not Found -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2120-0-0x0000000000B60000-0x0000000000B77000-memory.dmp upx behavioral1/memory/2120-13-0x0000000000B60000-0x0000000000B77000-memory.dmp upx behavioral1/files/0x000c000000014c67-16.dat upx behavioral1/memory/2124-17-0x0000000001220000-0x0000000001237000-memory.dmp upx behavioral1/files/0x000b00000001224c-21.dat upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" b24f3629767e95aa88e064dbe3480f9a.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe b24f3629767e95aa88e064dbe3480f9a.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2120 b24f3629767e95aa88e064dbe3480f9a.exe Token: SeDebugPrivilege 2124 CTS.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2956 2120 b24f3629767e95aa88e064dbe3480f9a.exe 28 PID 2120 wrote to memory of 2956 2120 b24f3629767e95aa88e064dbe3480f9a.exe 28 PID 2120 wrote to memory of 2956 2120 b24f3629767e95aa88e064dbe3480f9a.exe 28 PID 2120 wrote to memory of 2956 2120 b24f3629767e95aa88e064dbe3480f9a.exe 28 PID 2120 wrote to memory of 2124 2120 b24f3629767e95aa88e064dbe3480f9a.exe 30 PID 2120 wrote to memory of 2124 2120 b24f3629767e95aa88e064dbe3480f9a.exe 30 PID 2120 wrote to memory of 2124 2120 b24f3629767e95aa88e064dbe3480f9a.exe 30 PID 2120 wrote to memory of 2124 2120 b24f3629767e95aa88e064dbe3480f9a.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b24f3629767e95aa88e064dbe3480f9a.exe"C:\Users\Admin\AppData\Local\Temp\b24f3629767e95aa88e064dbe3480f9a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\53bTumaGm3J5GNT.exeC:\Users\Admin\AppData\Local\Temp\53bTumaGm3J5GNT.exe2⤵
- Executes dropped EXE
PID:2956
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD558d54f6ef0962ac67f3bba4fafc2816a
SHA10b7771bcc6d7fa94ec8528906e738f5bc1d35f9c
SHA256de85059eb7583ccf4b76dcc2bea00219c7c4bc59dc54f5ffba3fa1bc11725237
SHA512e2cdbd15b3a80698997c700c87bebd0a4c3be9219344aa92fc3264fbb905bd9010645bd5c43adcc40a3df49dcb41c3e91ce97858002cd02a9693f83cf8eb50d3
-
Filesize
35KB
MD593e5f18caebd8d4a2c893e40e5f38232
SHA1fd55c4e6bcd108bce60ea719c06dc9c4d0adafa6
SHA256a66c4b98becac2f69cb107cd087d7a2ca9ef511bc3b83367b1f440f11dd159a8
SHA512986583610d27caae2080834301d072557c5d2c85e33f0d19ab1245d7eae8db146397461572ddb3d491be16f3af210720d54267dac838fdad8fe34afa3d6b7f54
-
Filesize
16KB
MD595c9a037d3b01a21275aa6cc73b122a2
SHA1c19ed8afc95b91d0cc6bc075047de30eae015386
SHA2561d5edcbae3258efb07cc57ba8d7cd1ebe2eb5106ef1a894b787ed2857952c523
SHA512761bb76261712a597f610e3162fa1514d2f56d69d03d1b76b51c6b2a7b0c88bbd385b7dc849c6913f7d861fb3aed8551f26f640d90b621e8629abe2e4bfb6160