Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2024, 00:55

General

  • Target

    c43b93d8d1211736a16c46e657353bea880ba05e305436aff327594ea902631e.exe

  • Size

    135KB

  • MD5

    d59eb1d2e0e3ff69b9fda29eb1505e80

  • SHA1

    23ef392803e84cec96efde038664eaa279f81bd5

  • SHA256

    c43b93d8d1211736a16c46e657353bea880ba05e305436aff327594ea902631e

  • SHA512

    e9db97a91e857dd802e5d2c8617efa8d33b7025fd39c1e4fafd4be07bd669deed88a611bbe21d15e55cc66544d758491749e15eef4b3fd79521ca3be7733da21

  • SSDEEP

    1536:Fc8N7UsWjcd9w+AyabjDbxE+MwmvlzuazT56aPNU/lKs006vWufDOmmkJIR8wkga:ZRpAyazIliazT56WNRs006vZxDCGtga

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c43b93d8d1211736a16c46e657353bea880ba05e305436aff327594ea902631e.exe
    "C:\Users\Admin\AppData\Local\Temp\c43b93d8d1211736a16c46e657353bea880ba05e305436aff327594ea902631e.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Users\Admin\AppData\Local\Temp\IStBB4y7Cf5a82W.exe
      C:\Users\Admin\AppData\Local\Temp\IStBB4y7Cf5a82W.exe
      2⤵
      • Executes dropped EXE
      PID:4788
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1008
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4192 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2248

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

      Filesize

      789KB

      MD5

      ecb810d3e340f431c65e8852dc6c8f9d

      SHA1

      60f0c09d1703dd875366982f12dc9697b29594c8

      SHA256

      cd3eb68f7aaa29d77f61546f63c3ab894974b59b63749e4b4b947df62dda28ae

      SHA512

      4eba9fbf07eea660e89cd64639d9ac72d9e8d4534ac7baa258da67ec36afcfd7fefea1d05e9782b87053d7699a0b36a488b56ae0304040bf47021ea8a74baad5

    • C:\Users\Admin\AppData\Local\Temp\IStBB4y7Cf5a82W.exe

      Filesize

      64KB

      MD5

      e97c622b03fb2a2598bf019fbbe29f2c

      SHA1

      32698bd1d3a0ff6cf441770d1b2b816285068d19

      SHA256

      5c1af46c7300e87a73dacf6cf41ce397e3f05df6bd9c7e227b4ac59f85769160

      SHA512

      db70c62fb35a8e5b005f13b57c1ebbf6c465f6ff0524422294c43e27fb4aa79379dc1e300ad11dc2354405c43b192ae06b91c0f525a1f2617e4d14673651a87d

    • C:\Windows\CTS.exe

      Filesize

      71KB

      MD5

      f9d4ab0a726adc9b5e4b7d7b724912f1

      SHA1

      3d42ca2098475924f70ee4a831c4f003b4682328

      SHA256

      b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

      SHA512

      22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432