Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 03:25
Static task
static1
Behavioral task
behavioral1
Sample
d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe
Resource
win10v2004-20240412-en
General
-
Target
d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe
-
Size
84KB
-
MD5
1aa5d12031db932b9763fb0e4be44922
-
SHA1
0ce1130afdbceb1c46ec414e5fc343c326e25a08
-
SHA256
d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d
-
SHA512
6985c7cfeb2e7c4247ceccaf54b7ae713fd763f43ba5d028118e859857fa23646b0acdc6d1d6c6e489bb539d9574c221b0fe86da7520725ec0fdc0474455e36a
-
SSDEEP
768:JNK2cNW0QbRsWjcd+6yBFLqJ4Z8qx70RM8/O/B2Z9tRQ1LVXq+:pcNjQlsWjcd+xzl7SMQQ3Xq+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3036 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4852 d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe Token: SeDebugPrivilege 3036 CTS.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4852 wrote to memory of 3036 4852 d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe 85 PID 4852 wrote to memory of 3036 4852 d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe 85 PID 4852 wrote to memory of 3036 4852 d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe"C:\Users\Admin\AppData\Local\Temp\d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
402KB
MD56088d157a82d68cf1afdcc075b0f5f9e
SHA1f2028af708c43e16a8ead2d3f19d48605dbfbbd2
SHA256700e125ad03e4407ec85407c952d460c0e941d809b09dac162b3e18605c07781
SHA51233316d33f326832079d42e580724a55c607d0cd3143c9d38e416ac997b8c3142412e2b860451d67823d31de34b3774f8b1c9d28da71df4ac56f872fa9a401c95
-
Filesize
84KB
MD5bdfc34f0726fb7f40f3c2b5db3fe2695
SHA1f20254e6c423d28188eb42b162e605cb097acf94
SHA256052244dc4402c0ef6ef00c6ecdb31d2c678e0da447b6b9fe8b8af2283387b9cc
SHA5125013266a01f6d0048310dbe80ee55f4fa8357badae36c081bbdde9ad41c7fff037474219388cba13b4319fc60d6ffc65958acbba3527f040da3b2b79a5b4f688
-
Filesize
80KB
MD5ec704028ad7125c2fa52e04dc68c0ca3
SHA12a63f27d0138696c9c27a9ea2534e8f2ca11ddc4
SHA2565f77a5d7c9eac3b004820646dece450e315a6e3ed320dc183ae68d59cd2318bf
SHA512a008a08c980583b8698431ca44fa45d5565fdc5316dc3e58c47ae523e7a7a776162979b0c79f9c64f0b71e0d98fb49102679378354f76c270d0c99207c15d160