Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/05/2024, 00:46
General
-
Target
7f8236718e14c992a25256f72818696be35db8fb6398498a0e68e679907bc8e5.exe
-
Size
3.1MB
-
MD5
3d194c2fea82e0501a2b6abfd9c3a9da
-
SHA1
cbab5841da570d51fba5580b4201320111fbd537
-
SHA256
7f8236718e14c992a25256f72818696be35db8fb6398498a0e68e679907bc8e5
-
SHA512
f97bbf00be779344c1c1cfebe4d7eb52ea0cebd14c51bf17da52cd9cc3bf7845c39e480ea49bf15a8a2b75745a4dcae30ed3c228dfad5fe8113d78ca92d25616
-
SSDEEP
98304:wHgNDfXQ1veFPk5FaoCRrgGUDxuUyuFC4Qmd1:JDfgZeVmCJWlQQ/
Malware Config
Signatures
-
Executes dropped EXE 24 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 16 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f8236718e14c992a25256f72818696be35db8fb6398498a0e68e679907bc8e5.exe"C:\Users\Admin\AppData\Local\Temp\7f8236718e14c992a25256f72818696be35db8fb6398498a0e68e679907bc8e5.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~1.EXE2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec /i vcredist.msi3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 8962⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5ff18e85ef7af89d103d3d8a19e62a976
SHA19edddc5d800f577f78c388e147be13eadbf9908d
SHA25660f83195875c7681af03b46612b7da6f719f3688ad72ccc70184263f8594f2d6
SHA512f32a596185f2ac9fd25c328ea99ee6c1ac20107d06349ea4bf29ed674f93e3fe1a2f50b548612d1613deef3430e2dbe058410b86f7587b846b66180f661013fc
-
Filesize
781KB
MD57cdf9aa038e925796cb53ef3ad8ebff6
SHA1fa37ca1ade9002c74d87b90010ebcf8da9707e1a
SHA256c47c1720051ec6ea065db117e287dfb216f5715a15a89456010776ac1f766a9b
SHA51260cf1a6f7c7f036e497edd92f937d87847b205561d457ef4f14ef6f75bbc20d5c1ddbc04bc5988a4293035d8b131782b072fb839a31d2ddfaeaed10abfee8605
-
Filesize
805KB
MD5b1089920d11bdc24b023d6d26094aada
SHA15497a969c2fdbbc662ca1eb9b3f92168bced7c59
SHA2568f4ef163f2015e36a962f6f7284d46415aac6620a9f25fbb35d082de181b100e
SHA5127f944aef51515ce4b1a3c6bd7e7d2aef927bc1f0f398084e035d0441f119989e37c3abe487212f6b21d152a0f101065ef5055f8a9f9957799dd644cf82f85939
-
Filesize
2.1MB
MD515555dc6727e94c4332e492acd905aa4
SHA10ad1203c0b4e19cd5457ca157463bec4d49265b0
SHA2561408701b4666806db4087074bd1e4d8ac198f2cde68937526cfb973cc774933a
SHA5121ddc1eda8d69c8d102ca1fc79d9af7f71aeb80322cbae3e6ed08bd32c8eef266b7f63661558bc15f91d0c870d4bbea62da8469b6fb6d49938220ef980e01a169
-
Filesize
2.5MB
MD5f031c0d2b460209b47b91c46a3d202fe
SHA195040f80b0d203e1abaec4e06e0ec0e01c507d03
SHA256492826e1aacd984a00dd67a438386e4de883cc923cb1f25e265525a4cf70ed7b
SHA51218840649d19c5310d274bac69010514872a554bb5ecadb4af5fa3667ad1a6bf9d644b31393edbc1b60ace6eff907c79c078f8213948cf90fa4d1529c68ccc629
-
Filesize
2.4MB
MD5b31b234cb0f534069ba32aaaeacd7b2d
SHA1d6f90459f8bdbf7e75cc85affe9b137dc5e304e2
SHA256b5a652a1025f194f59e1349a1f26709d7ff7760067439b2d52d988a55d9340f0
SHA512138cb14f6018d3bddd78012c5b36a591fe70d1b2b7f9d3774230639302401be57e1a4d6098c66a83c47e67138ac6dbe79f64548e4c317bb804a4e9a3ffdf94ea
-
Filesize
588KB
MD5ce236bdb46909143e872b0e87f42101d
SHA1c90af3ff1c322d94bd4d6cc356922634e12ebbd8
SHA25610cc75c5e144c9213b303eb0690130c1c3908a8560f36ae5ef5289fe3e5c1131
SHA51232303e53f5188db19b9f75b98ebe1e6a7c46cda93f2992b04ba3c217125177f6e5c5ba32684ba872ba3f03006ca4a37f915612ee6c41c6c698e0d43382e1cac8
-
Filesize
1.7MB
MD5e77d7db463002c9a2974c67a19fe03c1
SHA1f7003d3b7e1590452dabf6a84c799e0ce5111491
SHA256998e44c062b323665656ed84534726c4a1162f05862f8b75967f0f3fd906f3b5
SHA51203ac09a3f0653e701212cacccfb8a60b80d7b2d385b02a936df70aecdcc7e0f6273713ca5df7fb8a1d3f27d91188a433930106dd6bbb274cef650a398edeeea7
-
Filesize
659KB
MD5050ac31cf51fe2dd5ad6ea1eeb370009
SHA1966ccb5bfe91319ce3a34e1c78e5b8cc1b5570c2
SHA25643ce6da6c7baf9d58736d6a59fca0832f149881b8a6bcc9e9635b9101bb94ecd
SHA5120ed6d12abf010e461e61865eb81c74537f0ea31ce9656ad02ad7cbc6c13ae63e75365d6017f6212e8bfc7ff3a6de89c43a4adb7b9b04d3036756d5fbb14772e0
-
Filesize
1.2MB
MD59085cb798ce84322790bee7d532921aa
SHA13c6615366e7e58b6f36a9937049c3f2115884838
SHA256dccb362ccf0928641da75ee4e79ac749f510636be28bbb85e0f4af6c61bbb4d8
SHA51273d630138141efecb6a49e8292122c371d023892ab125ade58f814efb7b346dd2f9405fbb3031851486c4af42ec6729b0e4598984168ea7c3c1785a3c096c50b
-
Filesize
578KB
MD5cac753c2b3bb0a8d615a9ffcb79a9c8e
SHA1f1679816de530aa14446aaed1aa53ae29babaa28
SHA25622763e043358b5a05976d33585ebbcf44c62c84e4074feb9e80da124a00c5cea
SHA5122fb289c7cbae007e18b42115906ff569c59c1d4078a4eacb468a3044278d06e785b7993acf97ed479bd5041d5d1c0230d763d05a003e15344e1200443a5b0a92
-
Filesize
940KB
MD5e815b08998849e7b669f40e849fbc9b9
SHA17b476e5ba45ef7c1435fba2cbd83aac71211c3d7
SHA256b0a10898b5d8b945f228bae0945561cc1c3197fb7da2b237d71ebb992dce9553
SHA512b49873fc9d864a96dd8664e02dda6d49029dbb6d09bea98e3e9ec5e21e008d315d706e0b3b1284dcc6da1ee1efed2d126c8b8c9af5be0d80cb4f8c3c62d4cc5e
-
Filesize
671KB
MD58ce8f7401d90532e8434800827dcbf1a
SHA1af08554d39ac6760fa58248fa5076712fd9ec320
SHA2561f34d39ba434f89f18313c9ab1f2da8014b3579f0a2a70a814e4ff00d448b689
SHA512402dbeb3bc557e00141e7325ee9cf10c342fb4039fcdd260634e82146215c8a230b701301430c59e6a42daf989a2d516590c7e092200dcac322d240262248cb1
-
Filesize
1.4MB
MD57290672f0e1ee8a2c11682c36ba08a2a
SHA10584b8806a425ce5935885d48a88677790bc4bae
SHA256666d30a2efe961014c9ba8b6fa792d081bcc022c6c54ae001b2a7b61697ef242
SHA51215889b716ba8044315ac52816613ff8554ed844ab18b5be3eeb74eba3bfc12751d2d5d86e3adfe0fb14ea78a4ce48fa3f34eed7303072941a983bcf4e5b88a5b
-
Filesize
1.8MB
MD5b35e33d94653e0afb7ba800fc35cd915
SHA13b69ba09bcf36b500aa0fe45e4ffbb18cce5a4ee
SHA256c62f63fce973d83676661891b78049dc1af922053c87c90b6fa4331365a0e880
SHA512c617cd3e6dea68eb4d32fb6e5de6074f0a320af1f9c847bf57c6150309c67ca06e5b405b273e58c6da6168a50593939c86ddb293ab1a5f3707a69b01e077ff38
-
Filesize
1.4MB
MD5b204f2b1205909bce246d2b2c11b7ad9
SHA12d2add7c76a528b354003b3a971234bf115e122c
SHA2566400349512020da6042bf840a3dd51ee1a6f61d64453fef6b1aa07788b29ca10
SHA5128c6066d2dad80e119da70c3a77afa39a1896d87b01dd2182ba0c2d33ba7824057724c189d804b814591ee0592b2be21738dae07d08e3226a064f4f7375787544
-
Filesize
885KB
MD5a0c94fc2ca3b9d6e483cf58fde2fd942
SHA14ce770ef290ce07fb8be69a089aba5c5857cefff
SHA25696fb10e1375e5aef76ac32d3cdc2757bd492c5042649a145dd9cbbe296a3cea3
SHA5127069b3eb3a1795c002ccf1e5e56fcfe47479ce0f0d46f66076960e8cd3875f29c0e7141535694afbff40cd2e8420d5b35e49cf156df37491649ffb09aef3034a
-
Filesize
2.0MB
MD52b3270386a237e3e382cfdd04d97f8a4
SHA1c0bb781c698435e6e2e06c48952e3e5e2fb9c05b
SHA2562d785611d3f31d573e69e7e21dc7c13eb420ce10d67d7299f9726185059e1b08
SHA5121372a8a36d92afa6571ff95f116e701d832e7e9702d0e87631379dfec2f82eb83da91f1ac2bb7ce9af6da441f4a03a2f22b9856e703e0049a0dabe3db661be56
-
Filesize
661KB
MD50eb9d2fd8689343c76ce51b36f122feb
SHA12e7244f1503e4650bdc37144a576cb23992bb727
SHA256e97b632450ea018537baa8e6f585fb74048459f15e106b5c7be6ac5e64d9bc52
SHA512ce98579a5ca116b0bd104bbcabd8a6f7855a46023f33c2546ea7156ece0a343f0c207458d9e30b7572b81e2df4cda8abbb5f84c18c98f2d3594da487f3dfca9e
-
Filesize
712KB
MD5826074b3f66a73e32bf85d6c5dd599c2
SHA14e27a7d98f3dfff763c7464ca8d5755751bea2e4
SHA2561a73e058386b4e35cbbb884f3dba73a7b76a5b9a4a9f4f750dc7e06efef50f8e
SHA51209e0b31b705e9c2617c659d51307c61ef6f9701b17796754679e493b3bf69871884904c30858b81751694bca04a5b0b79fe62535dc0c5f009d8ab3aeb1df4f40
-
Filesize
584KB
MD55930306d1797287e55066473daea2607
SHA1af3ee20c40a3f9dd7231938e9a3a85cec364af74
SHA256feba7ed765e7f0f68f5d73ca6a8d8e1dde1b9978c0b5f7377cf1a6664345182f
SHA512b753dbe13d428eb281c344559baa116e221c86505f1a7d6d7f3be4483230d7fc114df7f7a1954c8d3bf6a21f486d83fe402452e5d8bd14683311d67a5aa8d8a8
-
Filesize
1.3MB
MD5311e28e9dd5abbad4de587b46b109cce
SHA1a864baac9625126f44fcd05e7b8e1561cba6413f
SHA256526492d94c7b8942bf68c3a032d4625f6a919e49c6ab23ac5501936ac7ca4288
SHA5126931d8066a705717f509ba00366beedba424e5476114d7ea202c807ce7a644c25de40b96c2a50f468ee52a50650feabf207c75fa82136dbcd862532e6250a182
-
Filesize
772KB
MD5e1b2a8e21e71d79153de156997758a79
SHA11d80ffda617727d2b22ada1ca7c9a66ae5193c3c
SHA25621af9c76dc28b6af9caffe56d5dce4c944ba82c8e3e73e745d05ebb5c600d8d1
SHA512c8967b6de4ca4c4c979e0a1696ca6d205d9b59d8687586d29325c136be76727b58f686c2db0b38caa86ad0dbe7cb158de5ce80953e9ec9ce12a39f494ce58b18
-
Filesize
2.1MB
MD577b9b5ba842e5d26d21898bdada4eaa4
SHA14962f8c57db9e5f8653a70131b05de3635c1f8f8
SHA256a6dd14bff5f7dfce7a1de75e9d7a3208c7934db4ab476e3199166ee78e09c2a4
SHA5128770b8e76b1e50d0bafaef8aa07cc889bffbfcc16f6d2edeb875e2329bbfb0c6656b28efdebc01c145c20b4ae91262cd98c1f95231f021a253b4d9ec2b99ae5e
-
Filesize
635KB
MD543fe91f27835c87b1aab4df65ff235d0
SHA1a9b72d534fdf540d3fb21f1f3960fe46e4890674
SHA256dbdb625cb87684ae4500b937e590b884ae3767e1744db36d44d38b867bf92933
SHA5127959d8204b0d7f2782c205a296d0a6417732add1992073d7097dda796d3d94de2c17ed79416f29b0b973970d3b60fd6dd66086632cb6fdb29474a265ff608d78
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
384KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
384KB
-
Filesize
660KB
-
Filesize
660KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.0MB
-
Filesize
1.0MB