Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
20/04/2024, 00:58
General
-
Target
a3027d9d16fe2a6ee90f4d57a519e7a8be61baeca3b5a5ca5daa35da8d64b471.exe
-
Size
622KB
-
MD5
a48dc6f58a4b81f51fcbdd2153568c85
-
SHA1
11540e4f9c7fba27e953c155a136411fc2c4527a
-
SHA256
a3027d9d16fe2a6ee90f4d57a519e7a8be61baeca3b5a5ca5daa35da8d64b471
-
SHA512
4f407e77d332ff265dce879cd4020b1d31d62afc87e141da7de968ac677b1e6628ea5c7929a7f41f6451188343d928d964b23c64c6f2416c6c980e0e08a5d436
-
SSDEEP
12288:tuW6FggLbrQXbR7jqkf1Hm7tJc0FS3jicGWVSI7dMua43Ek0cIHAN4:tuW6LaRFdGJm0Q3WKVSwdr13Ek0VA
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3027d9d16fe2a6ee90f4d57a519e7a8be61baeca3b5a5ca5daa35da8d64b471.exe"C:\Users\Admin\AppData\Local\Temp\a3027d9d16fe2a6ee90f4d57a519e7a8be61baeca3b5a5ca5daa35da8d64b471.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8962⤵
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD59853ae10fb5675e713c637ca4ff18765
SHA1802b653b14e5e81375f12eb7725f2f211c5b8907
SHA256f1b87231241d22066f6ef1d8583112d67a54555d0ca7f404c58cd2ff6ae1bdd1
SHA5129bb542d951e8cab10a868369da3fd9c47ac370c8aff36aa40e803ac762a976d03ca3c4bbe7576093596be2a57081bc56199e51e675f02ae4d7cb444a6e80707b
-
Filesize
781KB
MD59204c68c8138367f66a9771b510c1e1f
SHA1160e1c11c60c4436c50f5d9aeadd461c565a4746
SHA2560f798a36bc6ef9691de85869d6fbc448b36c08995c7771f698bb9eba2b3e5a22
SHA5128ae10ea26dea093fbfe89ba0e87d0880b2e296b9ec683a509aae2f2c8f947008ae1c2f5c72f6476d4d9512b6e1743c97877d511db214b6d44f38ea65ed62b005
-
Filesize
805KB
MD54a9a432fbe692c3cd53425d2b21482db
SHA19752c8c5be03cb9dd8047b411b621b1de2a9dc46
SHA256604e9d297a61fb9acd2bb9adc1c1a613e57b0a773c4dae5733ed8e33862ddd69
SHA512fa9196406abee39f5f7b04fbf1f60cab66d712abe3227c482539a5b8e71efb344ebf50288fd07c0e34ed4823e3cee3eec5bb509ccc8ffd657072712827c07682
-
Filesize
2.1MB
MD5abfa755b7c3db7458df6c767dc022139
SHA1f745d017cc05d53998436f1c44c514d75efe7e61
SHA2562c2315089f6ff19f366574204da3c80569707b7414fa0447575110751e8124c8
SHA5128946de552e6aad8975f8f5c201a5e62188fed4f1daa8bc0e43ee674f64b8d1fa8d81a979e65c934da9f06a0c4e0fd42bd5e20c1afc066ad050e0331a7132d493
-
Filesize
588KB
MD5faf9df0113d4aeaec2cf182e4e5e3e7e
SHA1702a89d8769894632d72a11118501b68dec32eb5
SHA256b6e60b2c2f374c26d1a2ffef1a9a23f09e8f4299736578869823df9f1c7b20c8
SHA512be7fe896c7bb3156949ff299572e97804a9d29df5e52d4651154c298188b8337b89119a81f9cc52afe7330be729c0a8e010ea255af321d3cb78eff771a5cd5ce
-
Filesize
1.7MB
MD56cf5f2601edd2784774789f16ac69b4e
SHA14c0dcff7d03a2de3994efd2a86ec8f36f4688231
SHA2564dc8b5df6b286b2344bf3f67053b56b25277d2a8ddb3356303185ebaebcf1647
SHA5125b45226774aed69315c97e15964f1ac8472e85aea86ca15a08e5d1a53c6fb07dcb4c6fff76e1b8da72dca8fcb4fa7d9807eb4c7737c5924dd3527d4cbb05806a
-
Filesize
659KB
MD576b4c33ccb09e73692636db14828584d
SHA14c05520d1f6b6ed1a7a350ebb5cb67dd296da5ab
SHA256f195fe4fb9e21a877958640aa0297f0ef1a0adc18a1ea50d173a0b13b55d1b22
SHA512cd58762470a58e9d4973f50ea7c0ca1746324ab0a3af7bc9524946216bdd0af6f59ed55d253c797d7e95035ab53bc881a6c6ca876e3cc4e3d067cecf876a3671
-
Filesize
1.2MB
MD5bea41ac962fcbf7a7e605b4bfd9dd6d8
SHA14b19f12b62af49da8950051e16efbe9d5deb4c51
SHA2564661f7ce505afff7d7d3d326a65288aac5976a579df10f96c8ba0d6ad1f8d52e
SHA512cd596c2931966a2bcdf95e854af2a8ab3ca5ec3ed813925c1d6f0cb645c3263c33ffdc0dfacce08cf857e4b2b0759d3a3dcbd79d05a2d38c4f672c54a2989529
-
Filesize
578KB
MD5b4b9fcf2cbfe58fa6d309445342d8583
SHA1bb6b7c99da0095f4efad217df9b110423e02c5e2
SHA256e39d2a9885fbab4c6244d91c485c9b92431b5c9ba16fb90530b6f89f068b9b90
SHA512f02b8ee40eae4d1fb64becb19a938f6673dd1b57528276456a323486857cdf222be7355c536163f3a673f7d95f929fc97fca253997e62fd9f30b78ca116e2aae
-
Filesize
940KB
MD5b1f1dadd25a53a96a6272a4efce3171a
SHA1702f8e75e44823c3a15edb493cba51d7a4eb489b
SHA25663004b42b31f04fd99b4f99a1cc5b654e267beb682b040607a617ca47e6146a6
SHA512e417aae006aa80c61c1f84fab599036a1ec268dda64a56eb0cb3b885643b638a21ede457485f579903f6ef9872ee61f7c07aa9bc00dddc0555bcb8415116c2dc
-
Filesize
671KB
MD5cdd4e0d93c6568ca820c36b63abd8792
SHA15ce3528067d1dd97145d3aeaca806996d095ddcc
SHA2567d73c8a03f6f94c2ac8551d3abb4ab5aba10c3fa2028dfe90731e19e3c4b3d40
SHA512898c7fb80db93cc0ad1ad96479b58e4276fbf799e38edb7db6d4e4b26be247d9e5f7935d5b3fc8ae1cf3a715a645ad3facb2d8d8f321e4a91ccd954a1cd1a7a5
-
Filesize
1.4MB
MD59dbe64aeb2a6fd6cb73dcd06ba5ef183
SHA1f40a4dfa41d11d2bb49355c584a0b96a44638482
SHA256536b4bcb976d83a5f004d7a702d8b40917d2c8f5c61437f164c45d89199d1abd
SHA5121dea848122eb9f03f01574f546ed5dc94c8ff8809053509a9dec3d59de48fda460ccb10e042a5940c7d8d281cb49cfcfadb8756c1f6f4cbed5ee7f3c67c89844
-
Filesize
1.8MB
MD57a63cb63d4967166e6a3dfc238622041
SHA1aa3c10f1cd50e74e2e5cc9d6b76df71e57f7c1b6
SHA2562a6c2b9eac2d9be8f323a938f12942ee406068c83fcad4687050eb0fcdd135f5
SHA512141e0f3e3004ad64c32c3ffdfa4754370852957f0fea0db9b8da6ee1b2e4a67f8620213e72bfb9e61c80ae369f29be1d2c34b33da694ff7026a841098447fc39
-
Filesize
1.4MB
MD5a961399fb7e56d66a097d16182ad1634
SHA1463710b34400a657e9a39333cbb87a68cd097acb
SHA256e6abfec4ce613aeedfabe48ad9dc2f95df9a72ddd32d3ddc05de31bd4374b410
SHA512663ccbd386189da379e57ed743e6cb4d7b0b7d63675cbef3ee8f638551974dded42322319a2d96d3f754533617112b2bd2a5031b142b3850cac2751eafba4583
-
Filesize
885KB
MD52ae61f47eca362d3732e5ce1cb73bc60
SHA13161f62486ba15dc2481fa99d02b0f716f20c956
SHA256f90c1530a15df7d04a922e98bd4a1492aad34115f27198c2576820c17aeb37cd
SHA5128265dac08146a4ede403c39c493daf9b44bd50851d9579c2f02bd38fcfb75f63f76624a62903e6b981bbc40686bb6473037beb6031fcb00f14b8bac5e110f6d0
-
Filesize
2.0MB
MD5b58f3e1a39e9077b9b20734a7ff3965c
SHA132f391abb30e85369b8a84f311e87054fa05f7af
SHA25632c6b4d3349d0429cf844a73144852958ee055a03a592e441f2b1e00aa6e96b1
SHA5122a3e29f8a9b13c015db131c52788371da557150c5d6863fa93196f6d64aeb11fea985e51f35c67d09a5038b0e4f75f1b9bde49891f8798ba5d78b16f84fec0d8
-
Filesize
661KB
MD56d45841b7b40981926c20df9db03a1b4
SHA1915284c04cfca5f0314d5dcf1876052e8b3ad41f
SHA25665daf5d4a60aabd85b57ac614b7808713793b9f2c9960ea69dbc743f23700324
SHA5126b84896033eac9c4547bbb54117eabc49c4b5f26899c0b634b4008adc24c62f4a8c439c29d45abbd2b0ccf7f057676ceba66c1807af3b197e489fd7156c748ed
-
Filesize
712KB
MD52f411e3c54cf5d185dd2449f077e511a
SHA1a695ed711b393f39f758e7142632cf08309213e2
SHA25645a49320c70b575d9c7ce6b5479d0a4f12c95ec861f0137691e4b79c85bdb83c
SHA5128bfe9487780a09a384103e4bb78c8f27de8828b0fd6d22d91d29e72a56eb8bc01d16f43d305cb8db244d43b49db0b66e9914bab8f88569366a2e3799a9c5dd77
-
Filesize
584KB
MD57658b1f78b8b345a988a9072054840f5
SHA16bacdebfba86a52e3bbbc5f08f17f1354ebc57a1
SHA256b26799a2020561d20ed8d12b28b4703f5724c6d775040e97621a2e8b4bd7beeb
SHA512f7b13c24f26e04170a5be32f84800be6123aa999b12ae149c6dded2190e974af83a4a9b2c8de2d01149aa4b549d6a6a5185a49367b962bf761718e525efd6590
-
Filesize
1.3MB
MD5478421ab8ab3f7cc02a9993d692c3b12
SHA1331b4455bfe51b74cd3d23c703c338f83b2b5ca0
SHA256e3c6492fddfaac65f52100455f10979b2adcbf21e4f905b409c1d6764bd186ed
SHA51256cd78a5f27999832e214b4507d3ddb74f849886fca2f0f3e77d22d39e6eded4e0a60b46ed1251e7d5f9caa4c6aadc0c30197ffa427cb456159f71107996b414
-
Filesize
772KB
MD579cec175ddcdcae74444d22132b9e409
SHA10143945e7efc6b22ba8ac0486f7b4e86ba38b03b
SHA25671fc51a5094bbb683b4b09ee16a66abc4e966e9bc79523b201174d93a41c3338
SHA5128ec58e1920f526eefb4675e103684ddf0e20c00f1315128cd36ccea927fdb3fce0d9c59553ff5d7ee47ab553b4b087a1996d2c72e2423ec17647f828f513b054
-
Filesize
2.1MB
MD510f89884cfc2349216087c6dbd3398c0
SHA1a1466c7c5a00de231f6a4232fbc12d39f98d9b45
SHA256cb775a2a90854a4ceaf9091e64e324b74b3557a55879c7c9f87a6489ffd6dff8
SHA5121ea8ba48fe2f4ad41bd70332f397cf9ea4bb1e89ca8ba2f9fc05fa7354400074e3a564d70b8dad596f1e736855d8b20a9f59525b9be9019f5a0747608d430632
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
412KB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
600KB
-
Filesize
384KB
-
Filesize
600KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
792KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB