Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 08:32
Static task
static1
Behavioral task
behavioral1
Sample
76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe
Resource
win10v2004-20240226-en
General
-
Target
76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe
-
Size
400KB
-
MD5
11e20aa257ca42b9c2542ca924e1a6e8
-
SHA1
3fdf848f8a6adabd8a22fe15867fb298db79c1e2
-
SHA256
76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6
-
SHA512
7c6b46b1e7cc29bd5168f8b9b41a9d64eb6c98fe6f95dedcf6427afe179710f784895a02557b546d97669ce9ad6e471f9d14b9d867607f21ca8e3d272095ae97
-
SSDEEP
6144:OlcU2rm3BeTtiBlMsHTlI/sCTaldjq5oUT/U3t53s7NJ6T93kAXLO2/Oo8aILP:LU2r+YTotZCYjYNo3tdkO/OxpP
Malware Config
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe -
Executes dropped EXE 2 IoCs
pid Process 1180 u3qs.0.exe 2328 u3qs.1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x000800000002322b-68.dat upx behavioral1/memory/2328-75-0x0000000000400000-0x0000000000930000-memory.dmp upx behavioral1/memory/2328-83-0x0000000000400000-0x0000000000930000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3908 4852 WerFault.exe 89 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 u3qs.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString u3qs.0.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1908 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1180 u3qs.0.exe 1180 u3qs.0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2328 u3qs.1.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4852 wrote to memory of 1180 4852 76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe 97 PID 4852 wrote to memory of 1180 4852 76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe 97 PID 4852 wrote to memory of 1180 4852 76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe 97 PID 4852 wrote to memory of 2328 4852 76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe 107 PID 4852 wrote to memory of 2328 4852 76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe 107 PID 4852 wrote to memory of 2328 4852 76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe 107 PID 2328 wrote to memory of 2636 2328 u3qs.1.exe 113 PID 2328 wrote to memory of 2636 2328 u3qs.1.exe 113 PID 2328 wrote to memory of 2636 2328 u3qs.1.exe 113 PID 2636 wrote to memory of 928 2636 cmd.exe 115 PID 2636 wrote to memory of 928 2636 cmd.exe 115 PID 2636 wrote to memory of 928 2636 cmd.exe 115 PID 2636 wrote to memory of 1908 2636 cmd.exe 116 PID 2636 wrote to memory of 1908 2636 cmd.exe 116 PID 2636 wrote to memory of 1908 2636 cmd.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe"C:\Users\Admin\AppData\Local\Temp\76dcd11160dbe6f680c61a8e6bfb2199a6b1e63de3475ac11e01987cc2613fb6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\u3qs.0.exe"C:\Users\Admin\AppData\Local\Temp\u3qs.0.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1180
-
-
C:\Users\Admin\AppData\Local\Temp\u3qs.1.exe"C:\Users\Admin\AppData\Local\Temp\u3qs.1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:928
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F4⤵
- Creates scheduled task(s)
PID:1908
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 16402⤵
- Program crash
PID:3908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4852 -ip 48521⤵PID:3660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD582b83e67d3fbc356a07420923abeed36
SHA14887991a4b7d243d3f343aa111027a9f4fd03ecd
SHA25627d68b0754c0074f513e931700be53ba16fdcd76401bcf87149d46b5ba4e4be0
SHA5128690c2d1aaf663457707f2b9cf6b0ad26af4a9a5dab2fc77f77064579ab2b4abdd45d339f02fc4f865034ec945672ce76b48ec187330ee8910bf1c1a489b0588
-
Filesize
1.7MB
MD5eee5ddcffbed16222cac0a1b4e2e466e
SHA128b40c88b8ea50b0782e2bcbb4cc0f411035f3d5
SHA2562a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54
SHA5128f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc
-
Filesize
128B
MD511bb3db51f701d4e42d3287f71a6a43e
SHA163a4ee82223be6a62d04bdfe40ef8ba91ae49a86
SHA2566be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
SHA512907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2