Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
d9b0a4d3581657aec38a0af425c4d674.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d9b0a4d3581657aec38a0af425c4d674.exe
Resource
win10v2004-20240508-en
General
-
Target
d9b0a4d3581657aec38a0af425c4d674.exe
-
Size
332KB
-
MD5
d9b0a4d3581657aec38a0af425c4d674
-
SHA1
1502e180e019e2581212cc5b0f3e54e42b2b0499
-
SHA256
7a3c85a717e52bfa6bc2b39029d800635b0ecb32bcdc289201226facd1baecba
-
SHA512
b79185962b449f56bcf71b2f6819c085f7e0416af4359ffa2652223b00915ac1604b8b4043df499f0809857da399ab92dbaf817bf557cf3be99158c4ed81de68
-
SSDEEP
6144:xZ8azSxhpbAf6dfBiySfFmFV12iqE6ef6Skxo9FGBcYLa21rjReJxX:xC0SjpbAgfBiFtaTsokxElYlRjReJxX
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2192 76gBF0zHxjxvipg.exe 2852 CTS.exe -
Loads dropped DLL 2 IoCs
pid Process 1620 d9b0a4d3581657aec38a0af425c4d674.exe 2524 Process not Found -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" d9b0a4d3581657aec38a0af425c4d674.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CTS.exe d9b0a4d3581657aec38a0af425c4d674.exe File created C:\Windows\CTS.exe CTS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1620 d9b0a4d3581657aec38a0af425c4d674.exe Token: SeDebugPrivilege 2852 CTS.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2192 1620 d9b0a4d3581657aec38a0af425c4d674.exe 28 PID 1620 wrote to memory of 2192 1620 d9b0a4d3581657aec38a0af425c4d674.exe 28 PID 1620 wrote to memory of 2192 1620 d9b0a4d3581657aec38a0af425c4d674.exe 28 PID 1620 wrote to memory of 2192 1620 d9b0a4d3581657aec38a0af425c4d674.exe 28 PID 1620 wrote to memory of 2852 1620 d9b0a4d3581657aec38a0af425c4d674.exe 30 PID 1620 wrote to memory of 2852 1620 d9b0a4d3581657aec38a0af425c4d674.exe 30 PID 1620 wrote to memory of 2852 1620 d9b0a4d3581657aec38a0af425c4d674.exe 30 PID 1620 wrote to memory of 2852 1620 d9b0a4d3581657aec38a0af425c4d674.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9b0a4d3581657aec38a0af425c4d674.exe"C:\Users\Admin\AppData\Local\Temp\d9b0a4d3581657aec38a0af425c4d674.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\76gBF0zHxjxvipg.exeC:\Users\Admin\AppData\Local\Temp\76gBF0zHxjxvipg.exe2⤵
- Executes dropped EXE
PID:2192
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD5a53bd562507144e416626f695f7924a6
SHA16e079fc05ed1908504e3fccff1da5c039ae0e53c
SHA2563f0212d5e502441e571cde245ae3c2d992c679205b620ed23e1b0390ce91caf7
SHA5124f2b2f8be812f7457a6b226ac20e18ad01274dc08af7501e5c410d060343a7f6ab839c361188cff0e5218fee52e5e0563f48c117fbb2fbfe396f83d8bb9afda3
-
Filesize
71KB
MD5f9d4ab0a726adc9b5e4b7d7b724912f1
SHA13d42ca2098475924f70ee4a831c4f003b4682328
SHA256b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc
SHA51222a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432
-
Filesize
261KB
MD59dce6a120d094e5c925b967c4bb36277
SHA11ab60840e8d8ed14619fab2d1559f989f01f01a9
SHA2563052784f3683c2bbe95f59560eb311e75f1eac7aa5476a91bbd9fe4d2aef880a
SHA51220a7a4b8ecb1262ed730c8299ad0ada2ad93327f0886e5fdefc89564ff7510595ec53ac5aa88747e0548315c3037125d83756e3ae4d9a813cc553c12991c94df