Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 07:42

General

  • Target

    c2d777d0a4ff803af9dd3f29f6fc463c6050b85df44fa1ebaf5eb1ca2cf6c2dd.exe

  • Size

    17KB

  • MD5

    75a246b61bed3a7d65e02ddab65914e8

  • SHA1

    9b429d41d6ba4fdc384b94790475b2ef7ab1aad0

  • SHA256

    c2d777d0a4ff803af9dd3f29f6fc463c6050b85df44fa1ebaf5eb1ca2cf6c2dd

  • SHA512

    ba88a5f749513b20d8086475fc38b10ff2a442951b6a5f55c304d66e494cc6284ff5455e3a40822fd51ca410317e13fad18cc8d1ed7f3187be0b6db3b2903cb1

  • SSDEEP

    384:x+uPfoQ+DfYMzKdPEsOuubuEG3KHM2/ZYOdM:IMAQ+BzWPEwnE+KHM2/SH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2d777d0a4ff803af9dd3f29f6fc463c6050b85df44fa1ebaf5eb1ca2cf6c2dd.exe
    "C:\Users\Admin\AppData\Local\Temp\c2d777d0a4ff803af9dd3f29f6fc463c6050b85df44fa1ebaf5eb1ca2cf6c2dd.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    338KB

    MD5

    7d7d4dbb8b8b56f3e32c5a3f3d374d45

    SHA1

    9a685f260a73b7777651c407cec180bc54c2964b

    SHA256

    d183d9f6b27c838cb7fa8b39d476372d404a9c78d60659f9797fa72798da0ec8

    SHA512

    678869ce7c4e33895e761db63a5f6bb731eb599ed355fac3f11c1be9d2620f35353732a1a6535bbdf7bf3fa92fcd0ac8cb191f1c5e00015cc9eea4fe22216391

  • C:\Users\Admin\AppData\Local\Temp\AWNX1eht6mjTKo7.exe

    Filesize

    17KB

    MD5

    86fed561fc0fe114aba01fbb9ef8532f

    SHA1

    88b53d33421cec705c56213dbf47c0cf300dd565

    SHA256

    ec030726da5f3432002cacb1d3f3424637d057c2bbea67a0e56e1df88890c6f2

    SHA512

    764ba7af3b3e849e698edef12d1972fb7d77d7b85c5c58f8ae1fc71d737d3ff449ac1d3e8cf14057a4e0511dae9e4ccee9dc588f104495f8864124cac7d9c794

  • C:\Windows\svhost.exe

    Filesize

    16KB

    MD5

    76fd02b48297edb28940bdfa3fa1c48a

    SHA1

    bf5cae1057a0aca8bf3aab8b121fe77ebb0788ce

    SHA256

    07abd35f09b954eba7011ce18b225017c50168e039732680df58ae703324825c

    SHA512

    28c7bf4785547f6df9d678699a55cfb24c429a2bac5375733ff2f760c92933190517d8acd740bdf69c3ecc799635279af5d7ebd848c5b471318d1f330c441ff0