Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/05/2024, 04:47

General

  • Target

    7af723qerasfjh.exe

  • Size

    19.9MB

  • MD5

    743f1aa0734107e337b832d0d4282639

  • SHA1

    b93375432422e325761dee489f43a30146b5938a

  • SHA256

    064a251ebc40196671442bb37f305de56bfab684bf7e6a83fa7dd9cfc2d22b61

  • SHA512

    cd23c77faa8a6ea8db2322255afa40e503bcb436c2f184ff932fafef3ef086246e3b0694018885f2e48b7f4fd7f7d107f8c22b1ccf474a02937313d8363c03d5

  • SSDEEP

    393216:ASk1BFNPOs9enOfC4g+DooHmoiUZJW07/c7T+SekU1lm+Ky9v:InvPnZC/+UIm/UZrzJe+Nl

Score
10/10

Malware Config

Signatures

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe
    "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3408
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:1224
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4884
        • C:\Windows\system32\certutil.exe
          certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5
          3⤵
            PID:4872
          • C:\Windows\system32\find.exe
            find /i /v "md5"
            3⤵
              PID:4316
            • C:\Windows\system32\find.exe
              find /i /v "certutil"
              3⤵
                PID:4924
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3816
              • C:\Windows\system32\certutil.exe
                certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5
                3⤵
                  PID:2104
                • C:\Windows\system32\find.exe
                  find /i /v "md5"
                  3⤵
                    PID:800
                  • C:\Windows\system32\find.exe
                    find /i /v "certutil"
                    3⤵
                      PID:4324
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:776
                    • C:\Windows\system32\certutil.exe
                      certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5
                      3⤵
                        PID:568
                      • C:\Windows\system32\find.exe
                        find /i /v "md5"
                        3⤵
                          PID:1152
                        • C:\Windows\system32\find.exe
                          find /i /v "certutil"
                          3⤵
                            PID:2868
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3468
                          • C:\Windows\system32\certutil.exe
                            certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5
                            3⤵
                              PID:3624
                            • C:\Windows\system32\find.exe
                              find /i /v "md5"
                              3⤵
                                PID:3952
                              • C:\Windows\system32\find.exe
                                find /i /v "certutil"
                                3⤵
                                  PID:1380
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3960
                                • C:\Windows\system32\certutil.exe
                                  certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5
                                  3⤵
                                    PID:1008
                                  • C:\Windows\system32\find.exe
                                    find /i /v "md5"
                                    3⤵
                                      PID:3224
                                    • C:\Windows\system32\find.exe
                                      find /i /v "certutil"
                                      3⤵
                                        PID:5096
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2144
                                      • C:\Windows\system32\certutil.exe
                                        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5
                                        3⤵
                                          PID:4720
                                        • C:\Windows\system32\find.exe
                                          find /i /v "md5"
                                          3⤵
                                            PID:2920
                                          • C:\Windows\system32\find.exe
                                            find /i /v "certutil"
                                            3⤵
                                              PID:3052
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                                            2⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:5012
                                            • C:\Windows\system32\certutil.exe
                                              certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\7af723qerasfjh.exe" MD5
                                              3⤵
                                                PID:2404
                                              • C:\Windows\system32\find.exe
                                                find /i /v "md5"
                                                3⤵
                                                  PID:1252
                                                • C:\Windows\system32\find.exe
                                                  find /i /v "certutil"
                                                  3⤵
                                                    PID:4056
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c cls
                                                  2⤵
                                                    PID:936
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c cls
                                                    2⤵
                                                      PID:1908
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                    1⤵
                                                    • Drops file in Windows directory
                                                    • Enumerates system info in registry
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1900
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85ff9cc40,0x7ff85ff9cc4c,0x7ff85ff9cc58
                                                      2⤵
                                                        PID:2944
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,13263883089209647997,18038839435233446472,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1900 /prefetch:2
                                                        2⤵
                                                          PID:772
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,13263883089209647997,18038839435233446472,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2136 /prefetch:3
                                                          2⤵
                                                            PID:4616
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,13263883089209647997,18038839435233446472,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2216 /prefetch:8
                                                            2⤵
                                                              PID:2832
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,13263883089209647997,18038839435233446472,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3168 /prefetch:1
                                                              2⤵
                                                                PID:956
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,13263883089209647997,18038839435233446472,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3292 /prefetch:1
                                                                2⤵
                                                                  PID:776
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4464,i,13263883089209647997,18038839435233446472,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3580 /prefetch:1
                                                                  2⤵
                                                                    PID:4732
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3088,i,13263883089209647997,18038839435233446472,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4584 /prefetch:8
                                                                    2⤵
                                                                      PID:328
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4740,i,13263883089209647997,18038839435233446472,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4752 /prefetch:8
                                                                      2⤵
                                                                        PID:4628
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4636,i,13263883089209647997,18038839435233446472,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4864 /prefetch:8
                                                                        2⤵
                                                                          PID:2460
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4836,i,13263883089209647997,18038839435233446472,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4868 /prefetch:8
                                                                          2⤵
                                                                            PID:5040
                                                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                                                          1⤵
                                                                            PID:3468
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                            1⤵
                                                                              PID:2564

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                              Filesize

                                                                              649B

                                                                              MD5

                                                                              7d94ee9cab16ad84caab09dc3f89131d

                                                                              SHA1

                                                                              24e7fbb23eaac91e10fa4d08c095c4a65eae29c6

                                                                              SHA256

                                                                              1470fe19fc8036ff8a6c34ebba6393190d19bf7e83acf995d26cff5c38394737

                                                                              SHA512

                                                                              ae191e84fcb0fe36cdc07d3f42406b6a8693ff49d280968ae8a7ad361c91dfe5b78fd7247285f2c09c7b2d01a3884e003643c309046f582d8e206a4bfaf28298

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                                                              Filesize

                                                                              264KB

                                                                              MD5

                                                                              f50f89a0a91564d0b8a211f8921aa7de

                                                                              SHA1

                                                                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                              SHA256

                                                                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                              SHA512

                                                                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              f303696667adb364838214abd796dfb2

                                                                              SHA1

                                                                              27741ea4e88e273cdba19da9603f3502c003a26b

                                                                              SHA256

                                                                              677277b818e2b5b3e064bfa8a367d10f710b4aa48bff812ca9434bec651d637b

                                                                              SHA512

                                                                              0a10d6b689c0570578a1f4ff3d397d85a4cea7823369ba85c9f37995edf108525b5ab07f734e14b864a1384baa28f6a6ed545c6a96eeb48cb9468334cbde683b

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                              Filesize

                                                                              2B

                                                                              MD5

                                                                              d751713988987e9331980363e24189ce

                                                                              SHA1

                                                                              97d170e1550eee4afc0af065b78cda302a97674c

                                                                              SHA256

                                                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                              SHA512

                                                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                              Filesize

                                                                              352B

                                                                              MD5

                                                                              044d5c68070d15234d8edc6897d4de62

                                                                              SHA1

                                                                              5592f807e021783482dc1d787d3f98ae12748db8

                                                                              SHA256

                                                                              9c1cc660198ca739b13b4a5305af86edd67fabfa04c12857d2b2a3995194bba9

                                                                              SHA512

                                                                              2795c9ded3a6ea3aed52acb64cc84f9b90626deb3d24292e42267807c43087a2ecdb5d621e677750e48bfdf041455dda60f05ceb74490ce7addbbde0528ee613

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              c1a9491f3cf1d8b23bfe0ca64b4a6a66

                                                                              SHA1

                                                                              1e39682924f184f36eca063a62acd63b190c459c

                                                                              SHA256

                                                                              346700fb44561c9c291a2243df4d0b040f5135e73676dcb1147d50993be90d1b

                                                                              SHA512

                                                                              dfe2b8f6582c248dc4ceb2e3ebaef601a1f998495f4ca578df6e70d932ad8822194ecdc6b41ba9774913a4234c4dc35505fa253b649cea1e7ae01e25df86fae8

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                              Filesize

                                                                              15KB

                                                                              MD5

                                                                              1609b26a26bde278f72bb247ce6ca1b8

                                                                              SHA1

                                                                              a5730214b342ce5d3d04cfabd017de6743308387

                                                                              SHA256

                                                                              8958487f30546e5f3e887e6ca771e2d083c7a8c1ebef4b37595a2f8a1eb09618

                                                                              SHA512

                                                                              683b0498468f5f6afe9cc8cc53fbb2a4574cbaeb4f43d83ebef9cd5f3c2fd22ebdf06df1b269c7f5b9b262cf19d5fed90b13cd5470b343597d5781e43a790f38

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                              Filesize

                                                                              153KB

                                                                              MD5

                                                                              8e28bf224aa40fdf414abeb6d6619811

                                                                              SHA1

                                                                              59fee0b48f3a8edb1727e5dc5aa2f602da0517f2

                                                                              SHA256

                                                                              9b23bd109261709a0cdb54cefe93d794409f31659ac0d37962e15136f388b332

                                                                              SHA512

                                                                              11be8871b333a25b0383a91fd14dbff17e80a847a39cc76fa52c073f202747048d98b3930bc44a1c45bd8deeff6ea710e2fba1a67914bdf279305da907753fb9

                                                                            • C:\Windows\INF\1233213.html

                                                                              Filesize

                                                                              29B

                                                                              MD5

                                                                              93976e4f3097da93a349f8df3dab9b33

                                                                              SHA1

                                                                              1aa92305c3639f67c02283efd8350b880cdd4ddb

                                                                              SHA256

                                                                              103572181278b7aa5e661a5932d0640332e93f5120c722f4ed138817e24072bf

                                                                              SHA512

                                                                              ecc786990c02076d574813fdf82a6266006ee25ffd6948369afecbd9d253e328999cbecda48b2f6f467268c7d6013d8d5c8ea11c85b0b214d4b1f301df1d3d68

                                                                            • memory/3408-8-0x00007FF6D7630000-0x00007FF6D9EE3000-memory.dmp

                                                                              Filesize

                                                                              40.7MB

                                                                            • memory/3408-25-0x00007FF6D7630000-0x00007FF6D9EE3000-memory.dmp

                                                                              Filesize

                                                                              40.7MB

                                                                            • memory/3408-15-0x00007FF6D7630000-0x00007FF6D9EE3000-memory.dmp

                                                                              Filesize

                                                                              40.7MB

                                                                            • memory/3408-10-0x00007FF6D8003000-0x00007FF6D8AF7000-memory.dmp

                                                                              Filesize

                                                                              11.0MB

                                                                            • memory/3408-9-0x00007FF6D7630000-0x00007FF6D9EE3000-memory.dmp

                                                                              Filesize

                                                                              40.7MB

                                                                            • memory/3408-0-0x00007FF6D8003000-0x00007FF6D8AF7000-memory.dmp

                                                                              Filesize

                                                                              11.0MB

                                                                            • memory/3408-7-0x00007FF6D7630000-0x00007FF6D9EE3000-memory.dmp

                                                                              Filesize

                                                                              40.7MB

                                                                            • memory/3408-3-0x00007FF6D7630000-0x00007FF6D9EE3000-memory.dmp

                                                                              Filesize

                                                                              40.7MB

                                                                            • memory/3408-2-0x00007FF86FFA0000-0x00007FF86FFA2000-memory.dmp

                                                                              Filesize

                                                                              8KB

                                                                            • memory/3408-1-0x00007FF86FF90000-0x00007FF86FF92000-memory.dmp

                                                                              Filesize

                                                                              8KB