Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2024, 23:29

General

  • Target

    d055e064dea25697b95c6f87ed8bb4f45d5c3c9ffc9119db2f08bca6a70bd20f.exe

  • Size

    17KB

  • MD5

    5e85098f6c51b95bce6e43034c9cfeee

  • SHA1

    3795421fb2d194b5efabc725547abe41de41369e

  • SHA256

    d055e064dea25697b95c6f87ed8bb4f45d5c3c9ffc9119db2f08bca6a70bd20f

  • SHA512

    32e681990358b3f9d17ce36c9dc0a22d4b0260f9104cc62d0a4cb1b5ade41f56bd3cbc1561ae2fd740db42a7b0095c0d5edbaa03d3a961bb948e9dae6e5d0485

  • SSDEEP

    384:WWjjfoQ+DfYMzKdPEsOuubuEG3KHM2/wo:ljjAQ+BzWPEwnE+KHM2/V

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d055e064dea25697b95c6f87ed8bb4f45d5c3c9ffc9119db2f08bca6a70bd20f.exe
    "C:\Users\Admin\AppData\Local\Temp\d055e064dea25697b95c6f87ed8bb4f45d5c3c9ffc9119db2f08bca6a70bd20f.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    734KB

    MD5

    1fca53dd09454a8ba1e3f8fbb8d36997

    SHA1

    d7cd128bca15156ca20443a736996a53cf579606

    SHA256

    5ac50d4e8fe25b4f5467bd7ae1b6d6e3d49135bd9d65e2b54a11b674e5e56808

    SHA512

    c532329d039db5fa3fc4c71554bd8c1fe6322a2c4953aa0b8c93708926b729bf188ff12a19ca5f412abc350f1a1f66441b53a507de2b1f15e43f995bab3163c6

  • C:\Users\Admin\AppData\Local\Temp\JcoZDKq5eSSCB5S.exe

    Filesize

    17KB

    MD5

    024cee9b4202e34023920e5f8498f4e4

    SHA1

    8926095194b9d16c8453827e05bdbe3fc0b6a7cf

    SHA256

    99bb4dea76bc91e8fac4cd12b60a1e29391fe663c7584452bb2b555f84d4cf8a

    SHA512

    d151bc41d35abd120d4f747c1f9e6da5873e853fbe40cd69537f9dc8f695466505bdec50d8748844327fed4bf0148de9e65956464d739c21bcd6599328170b43

  • C:\Windows\svhost.exe

    Filesize

    16KB

    MD5

    5e7c375139b7453abd0b91a8a220f8e5

    SHA1

    88a3d645fab0f4129c1e485c90b593ab60e469ae

    SHA256

    36ec99991653fa54be6f638d0b95eeac3e3f5e3006e4320318c4aa6fc2e330a8

    SHA512

    0805763fe788e0edeb69747d2f419842dc093c2d871d39f25afe2cd27867d54f90fa15892ff5e8c7148280c1ca9b90a0a375f56c277e5d442257c9e77295f1b2