Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 03:58

General

  • Target

    e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe

  • Size

    1.0MB

  • MD5

    075871f9bc9e82f769ac26bb9c6fb6b3

  • SHA1

    9ac632584d336b025130af45da627c1c0bd68ba2

  • SHA256

    e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876

  • SHA512

    90a4089cf25493f7d0489caa0ee93b96cbac9e15d2596f1f7a03ec1e59c3dd85a63ea6a4c7cf9b40cbea87d15b0884c442f75a33cce53d6619bb33375f99b3f1

  • SSDEEP

    24576:zQ5aILMCfmAUjzX6xQ0+wCIygDsAUSTsU9CT6:E5aIwC+Agr6SNass

Malware Config

Signatures

  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

  • KPOT Core Executable 1 IoCs
  • Trickbot

    Developed in 2016, TrickBot is one of the more recent banking Trojans.

  • Trickbot x86 loader 1 IoCs

    Detected Trickbot's x86 loader that unpacks the x86 payload.

  • Executes dropped EXE 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe
    "C:\Users\Admin\AppData\Local\Temp\e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe
      C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
          PID:4100
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4400,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
      1⤵
        PID:4464
      • C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe
        C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
            PID:4536
        • C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe
          C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4828
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe
            2⤵
              PID:2536

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\WinSocket\e0e46ed37837243b080af736c9efa1f3a9a6f17d67900ffdc87967770c499987.exe

            Filesize

            1.0MB

            MD5

            075871f9bc9e82f769ac26bb9c6fb6b3

            SHA1

            9ac632584d336b025130af45da627c1c0bd68ba2

            SHA256

            e0e45ed36736243b070af635c9efa1f3a8a5f16d56900ffdc76956660c498876

            SHA512

            90a4089cf25493f7d0489caa0ee93b96cbac9e15d2596f1f7a03ec1e59c3dd85a63ea6a4c7cf9b40cbea87d15b0884c442f75a33cce53d6619bb33375f99b3f1

          • C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini

            Filesize

            35KB

            MD5

            7176e768438bdd83d532b74912cdfea4

            SHA1

            bb5126ae337809ca711a7078f2eabb70024f757a

            SHA256

            e824eb65ea436d3f0fd06dafb500cd0b4c524cbecd5ce5802c6af72d65f34ecf

            SHA512

            3223a7fcaa0dd40d792b725e679896b28b4e86f08fad3387e040abf137d10c0c492152fe32727664639b5caecbf92410fb8391c555d5a5b2e666aff0271f0415

          • memory/2840-73-0x0000000000400000-0x0000000000472000-memory.dmp

            Filesize

            456KB

          • memory/2840-72-0x0000000000421000-0x0000000000422000-memory.dmp

            Filesize

            4KB

          • memory/2840-58-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-59-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-60-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-61-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-62-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-63-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-64-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-65-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-66-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-67-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-68-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2840-69-0x0000000001B20000-0x0000000001B21000-memory.dmp

            Filesize

            4KB

          • memory/2928-34-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-51-0x00000000030A0000-0x000000000315E000-memory.dmp

            Filesize

            760KB

          • memory/2928-32-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-31-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-30-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-37-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-36-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-35-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-52-0x0000000003160000-0x0000000003429000-memory.dmp

            Filesize

            2.8MB

          • memory/2928-29-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-28-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-27-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-26-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/2928-41-0x0000000010000000-0x0000000010007000-memory.dmp

            Filesize

            28KB

          • memory/2928-42-0x0000000010000000-0x0000000010007000-memory.dmp

            Filesize

            28KB

          • memory/2928-40-0x0000000000400000-0x0000000000472000-memory.dmp

            Filesize

            456KB

          • memory/2928-33-0x00000000020C0000-0x00000000020C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-3-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-9-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-8-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-4-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-6-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-7-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-2-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-14-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-13-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-15-0x00000000021E0000-0x0000000002209000-memory.dmp

            Filesize

            164KB

          • memory/3212-10-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-11-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-12-0x00000000021C0000-0x00000000021C1000-memory.dmp

            Filesize

            4KB

          • memory/3212-17-0x0000000000421000-0x0000000000422000-memory.dmp

            Filesize

            4KB

          • memory/3212-18-0x0000000000400000-0x0000000000472000-memory.dmp

            Filesize

            456KB

          • memory/4100-46-0x0000000010000000-0x000000001001E000-memory.dmp

            Filesize

            120KB

          • memory/4100-53-0x000001BFC8680000-0x000001BFC8681000-memory.dmp

            Filesize

            4KB