Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2024, 14:02
Behavioral task
behavioral1
Sample
b24f3629767e95aa88e064dbe3480f9a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b24f3629767e95aa88e064dbe3480f9a.exe
Resource
win10v2004-20240226-en
General
-
Target
b24f3629767e95aa88e064dbe3480f9a.exe
-
Size
52KB
-
MD5
b24f3629767e95aa88e064dbe3480f9a
-
SHA1
6d3670b669317a1b8b1e1ac55f86f1526a9424c8
-
SHA256
e920922b09518fb34a15c2dcb673c66a1034de0463f5400270da6dfeab381202
-
SHA512
5bf398fa9f96a756befc1a2faf60e2a7c1888410d6e9fe6ad7467b63d4b231d03bcfb93e101cba6e0762799aa6770a4993edd32dd5260d450dbf92fb7bd45103
-
SSDEEP
768:X8Q2ZDX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIom46+IsRF9fFoFict+kRaXP:s9Z3KcR4mjD9r8226+3RFFFoFNtD78kq
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 5060 TopkhXiSrLju4Jw.exe 1800 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3192-0-0x00000000002A0000-0x00000000002B7000-memory.dmp upx behavioral2/files/0x000800000002333c-6.dat upx behavioral2/memory/3192-8-0x00000000002A0000-0x00000000002B7000-memory.dmp upx behavioral2/memory/1800-9-0x00000000001C0000-0x00000000001D7000-memory.dmp upx behavioral2/files/0x000300000002270b-13.dat upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" b24f3629767e95aa88e064dbe3480f9a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe b24f3629767e95aa88e064dbe3480f9a.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3192 b24f3629767e95aa88e064dbe3480f9a.exe Token: SeDebugPrivilege 1800 CTS.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3192 wrote to memory of 5060 3192 b24f3629767e95aa88e064dbe3480f9a.exe 94 PID 3192 wrote to memory of 5060 3192 b24f3629767e95aa88e064dbe3480f9a.exe 94 PID 3192 wrote to memory of 1800 3192 b24f3629767e95aa88e064dbe3480f9a.exe 96 PID 3192 wrote to memory of 1800 3192 b24f3629767e95aa88e064dbe3480f9a.exe 96 PID 3192 wrote to memory of 1800 3192 b24f3629767e95aa88e064dbe3480f9a.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\b24f3629767e95aa88e064dbe3480f9a.exe"C:\Users\Admin\AppData\Local\Temp\b24f3629767e95aa88e064dbe3480f9a.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\TopkhXiSrLju4Jw.exeC:\Users\Admin\AppData\Local\Temp\TopkhXiSrLju4Jw.exe2⤵
- Executes dropped EXE
PID:5060
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:81⤵PID:1212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
358KB
MD5c6bb5f16e2c24d0f96a2956f58f80148
SHA165d07c3ab62a91bb6be36f7fd7b9ecff8bac596d
SHA256bb3f5b1d532db732912109070d8208ecaeff1a0dce59a16cf2015df20bb25071
SHA512f8b5a3eac7570a842d67d2ea01e12c2ab5dd12bda0f68816df1e4c805efdd212b83beec071febce6493dec22a29e7262a50ec86243bea411bcc23bb2e8b522b0
-
Filesize
16KB
MD595c9a037d3b01a21275aa6cc73b122a2
SHA1c19ed8afc95b91d0cc6bc075047de30eae015386
SHA2561d5edcbae3258efb07cc57ba8d7cd1ebe2eb5106ef1a894b787ed2857952c523
SHA512761bb76261712a597f610e3162fa1514d2f56d69d03d1b76b51c6b2a7b0c88bbd385b7dc849c6913f7d861fb3aed8551f26f640d90b621e8629abe2e4bfb6160
-
Filesize
35KB
MD593e5f18caebd8d4a2c893e40e5f38232
SHA1fd55c4e6bcd108bce60ea719c06dc9c4d0adafa6
SHA256a66c4b98becac2f69cb107cd087d7a2ca9ef511bc3b83367b1f440f11dd159a8
SHA512986583610d27caae2080834301d072557c5d2c85e33f0d19ab1245d7eae8db146397461572ddb3d491be16f3af210720d54267dac838fdad8fe34afa3d6b7f54