Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 16:51
Behavioral task
behavioral1
Sample
de7b9f7d415d093a6f0fe34d70628988.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
de7b9f7d415d093a6f0fe34d70628988.exe
Resource
win10v2004-20240226-en
General
-
Target
de7b9f7d415d093a6f0fe34d70628988.exe
-
Size
59KB
-
MD5
de7b9f7d415d093a6f0fe34d70628988
-
SHA1
0a460859559bfefb7565e9033a359b9c0d6fa1ea
-
SHA256
a83460c020322cb131144dfaf6c220f73c6d86cf5683ea5baeb87a7c7aa35c7e
-
SHA512
eebeb8ef7e5f55f8ac044b7e3f9af33cfb3b7d904ad1dfc45f440adb34e2335ac1edbb9dd89a254139cdcf302d391996e5dc3fb6eeb4a5be6be641b88d09d4a8
-
SSDEEP
768:XocAX3LKew369lp2z3Sd4baFXLjwP/Tgj93b8NIocVSEFGocAX3LKew369lp2z36:SKcR4mjD9r823FHKcR4mjD9r823FJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2644 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/224-0-0x0000000000E20000-0x0000000000E37000-memory.dmp upx behavioral2/files/0x000a000000023224-6.dat upx behavioral2/memory/224-7-0x0000000000E20000-0x0000000000E37000-memory.dmp upx behavioral2/memory/2644-9-0x00000000006C0000-0x00000000006D7000-memory.dmp upx behavioral2/files/0x000300000002274b-12.dat upx behavioral2/files/0x000700000001e59e-30.dat upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" de7b9f7d415d093a6f0fe34d70628988.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe de7b9f7d415d093a6f0fe34d70628988.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 224 de7b9f7d415d093a6f0fe34d70628988.exe Token: SeDebugPrivilege 2644 CTS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 224 wrote to memory of 2644 224 de7b9f7d415d093a6f0fe34d70628988.exe 89 PID 224 wrote to memory of 2644 224 de7b9f7d415d093a6f0fe34d70628988.exe 89 PID 224 wrote to memory of 2644 224 de7b9f7d415d093a6f0fe34d70628988.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\de7b9f7d415d093a6f0fe34d70628988.exe"C:\Users\Admin\AppData\Local\Temp\de7b9f7d415d093a6f0fe34d70628988.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
382KB
MD5f97dd64d13fb1cc6e8f053725e37fb80
SHA1c9cc6b8c83162de97c10d789488342fdebc551e7
SHA2564a1c6d87a55365ba9d5e6bc89d1dacbe1d553118cb2e087fcdbf820f053b066b
SHA512451694bcf882e7c5241c2f316c5232061fc709517f95cc39ca4838f92fd68b44e94d6f81f82f630213e78559f1f62ea4bf294f4829b870468fbe706f964e7485
-
Filesize
59KB
MD546d5506aea32656087e669555ede3c1c
SHA103a138b938c8cb82a11d6124df43884f4e91648b
SHA256864cda01a0ee4eb8c65bfa3e4749d8dba2f9fdc5508a356fadb1a76ce5fcaa2a
SHA51273eaef5244450b119d3f7bce586ffa0f7f45f3c4bcb22a27210d18131cebba86131be4354780a6c720119b0344e1b746aadc241b7bd4ef75e557f3b7f119aec7
-
Filesize
59KB
MD55efd390d5f95c8191f5ac33c4db4b143
SHA142d81b118815361daa3007f1a40f1576e9a9e0bc
SHA2566028434636f349d801465f77af3a1e387a9c5032942ca6cadb6506d0800f2a74
SHA512720fbe253483dc034307a57a2860c8629a760f883603198d1213f5290b7f236bf0f5f237728ebed50962be83dc7dc4abe61a1e9a55218778495fc6580eb20b3d