Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 01:11

General

  • Target

    8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe

  • Size

    214KB

  • MD5

    e51d599b324ad10122152e23708929a1

  • SHA1

    6fd4292756494f42a83fcfa8c984b4f182bd4aab

  • SHA256

    8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047

  • SHA512

    a6015b4206a680046d2b8b3221627cbed6c63dd1990ec3e76fb7d72862492b89e788662d0396f76c30ed93cff3351e4f8b471b49ed032fc610f2cddf92e7a468

  • SSDEEP

    3072:ZhpAyazIlyazTZPs1BXsDu8EJUzdCmzZBr5oTsOt1LchIUN80vGdPXGztH3j1tJJ:hZMazQX0ax9JtnSaPGp3ZtJ0i

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe
    "C:\Users\Admin\AppData\Local\Temp\8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Users\Admin\AppData\Local\Temp\l6vZda0qGQcNPib.exe
      C:\Users\Admin\AppData\Local\Temp\l6vZda0qGQcNPib.exe
      2⤵
      • Executes dropped EXE
      PID:2904
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3788

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    394KB

    MD5

    d51fb01dcf1f7035fc81f72a62e500f5

    SHA1

    3a97f9e0927c05c8c0b2b453ab1bec8975a3b4f4

    SHA256

    47449e54da24e0b486802414e53e4a08e17614057c79a5bec55473e6ddf52c96

    SHA512

    7983e31f9d945279a5732f942f5c054d4c88d77df3ffa078bc83a004f29152c3b6ac1f54907f414b75caa90a34a6966f88988a9850980b7f3a29ce31eb1279d6

  • C:\Users\Admin\AppData\Local\Temp\l6vZda0qGQcNPib.exe

    Filesize

    143KB

    MD5

    38f108cddb6619fba80f8382d5227ece

    SHA1

    12fd277bf756f22cfae3043900e4aff8b9f05ed9

    SHA256

    8296fe257b8c34398e3f291764454ec3cd9cbe06d60989b632ef4ba6c73ae5dc

    SHA512

    3db732c23f10122c78cffc6b6a5b11836ade1a23f5c6f9a192f2be2fa99c5bd7afb7a9e29c5d518a888cdd2091f9ac41b244214be226152830e96f5ec2cca424

  • C:\Windows\CTS.exe

    Filesize

    71KB

    MD5

    66df4ffab62e674af2e75b163563fc0b

    SHA1

    dec8a197312e41eeb3cfef01cb2a443f0205cd6e

    SHA256

    075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

    SHA512

    1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25

  • memory/2904-10-0x00007FFADBFD3000-0x00007FFADBFD5000-memory.dmp

    Filesize

    8KB

  • memory/2904-8-0x0000000000970000-0x0000000000998000-memory.dmp

    Filesize

    160KB