Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe
Resource
win10v2004-20240426-en
General
-
Target
8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe
-
Size
214KB
-
MD5
e51d599b324ad10122152e23708929a1
-
SHA1
6fd4292756494f42a83fcfa8c984b4f182bd4aab
-
SHA256
8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047
-
SHA512
a6015b4206a680046d2b8b3221627cbed6c63dd1990ec3e76fb7d72862492b89e788662d0396f76c30ed93cff3351e4f8b471b49ed032fc610f2cddf92e7a468
-
SSDEEP
3072:ZhpAyazIlyazTZPs1BXsDu8EJUzdCmzZBr5oTsOt1LchIUN80vGdPXGztH3j1tJJ:hZMazQX0ax9JtnSaPGp3ZtJ0i
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2904 l6vZda0qGQcNPib.exe 3788 CTS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" 8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe 8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4808 8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe Token: SeDebugPrivilege 3788 CTS.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4808 wrote to memory of 2904 4808 8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe 83 PID 4808 wrote to memory of 2904 4808 8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe 83 PID 4808 wrote to memory of 3788 4808 8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe 85 PID 4808 wrote to memory of 3788 4808 8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe 85 PID 4808 wrote to memory of 3788 4808 8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe"C:\Users\Admin\AppData\Local\Temp\8985b3f63741d745051a1e60e08ef43a1eee98507666b42acbc859888edf8047.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\l6vZda0qGQcNPib.exeC:\Users\Admin\AppData\Local\Temp\l6vZda0qGQcNPib.exe2⤵
- Executes dropped EXE
PID:2904
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
394KB
MD5d51fb01dcf1f7035fc81f72a62e500f5
SHA13a97f9e0927c05c8c0b2b453ab1bec8975a3b4f4
SHA25647449e54da24e0b486802414e53e4a08e17614057c79a5bec55473e6ddf52c96
SHA5127983e31f9d945279a5732f942f5c054d4c88d77df3ffa078bc83a004f29152c3b6ac1f54907f414b75caa90a34a6966f88988a9850980b7f3a29ce31eb1279d6
-
Filesize
143KB
MD538f108cddb6619fba80f8382d5227ece
SHA112fd277bf756f22cfae3043900e4aff8b9f05ed9
SHA2568296fe257b8c34398e3f291764454ec3cd9cbe06d60989b632ef4ba6c73ae5dc
SHA5123db732c23f10122c78cffc6b6a5b11836ade1a23f5c6f9a192f2be2fa99c5bd7afb7a9e29c5d518a888cdd2091f9ac41b244214be226152830e96f5ec2cca424
-
Filesize
71KB
MD566df4ffab62e674af2e75b163563fc0b
SHA1dec8a197312e41eeb3cfef01cb2a443f0205cd6e
SHA256075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163
SHA5121588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25