Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2024, 03:25

General

  • Target

    d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe

  • Size

    84KB

  • MD5

    1aa5d12031db932b9763fb0e4be44922

  • SHA1

    0ce1130afdbceb1c46ec414e5fc343c326e25a08

  • SHA256

    d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d

  • SHA512

    6985c7cfeb2e7c4247ceccaf54b7ae713fd763f43ba5d028118e859857fa23646b0acdc6d1d6c6e489bb539d9574c221b0fe86da7520725ec0fdc0474455e36a

  • SSDEEP

    768:JNK2cNW0QbRsWjcd+6yBFLqJ4Z8qx70RM8/O/B2Z9tRQ1LVXq+:pcNjQlsWjcd+xzl7SMQQ3Xq+

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe
    "C:\Users\Admin\AppData\Local\Temp\d64886fa6c496b46f5faa38c407193bcfe85f734fa778cc08409cebd542bde3d.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4852
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    402KB

    MD5

    6088d157a82d68cf1afdcc075b0f5f9e

    SHA1

    f2028af708c43e16a8ead2d3f19d48605dbfbbd2

    SHA256

    700e125ad03e4407ec85407c952d460c0e941d809b09dac162b3e18605c07781

    SHA512

    33316d33f326832079d42e580724a55c607d0cd3143c9d38e416ac997b8c3142412e2b860451d67823d31de34b3774f8b1c9d28da71df4ac56f872fa9a401c95

  • C:\Users\Admin\AppData\Local\Temp\ZR77pryVr3BcumR.exe

    Filesize

    84KB

    MD5

    bdfc34f0726fb7f40f3c2b5db3fe2695

    SHA1

    f20254e6c423d28188eb42b162e605cb097acf94

    SHA256

    052244dc4402c0ef6ef00c6ecdb31d2c678e0da447b6b9fe8b8af2283387b9cc

    SHA512

    5013266a01f6d0048310dbe80ee55f4fa8357badae36c081bbdde9ad41c7fff037474219388cba13b4319fc60d6ffc65958acbba3527f040da3b2b79a5b4f688

  • C:\Windows\CTS.exe

    Filesize

    80KB

    MD5

    ec704028ad7125c2fa52e04dc68c0ca3

    SHA1

    2a63f27d0138696c9c27a9ea2534e8f2ca11ddc4

    SHA256

    5f77a5d7c9eac3b004820646dece450e315a6e3ed320dc183ae68d59cd2318bf

    SHA512

    a008a08c980583b8698431ca44fa45d5565fdc5316dc3e58c47ae523e7a7a776162979b0c79f9c64f0b71e0d98fb49102679378354f76c270d0c99207c15d160