Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    28/06/2024, 01:47

General

  • Target

    b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe

  • Size

    869KB

  • MD5

    52301e2e4f83bc459f2a1fc537000853

  • SHA1

    d32fd82310fdb782a2ae0c6a7b5cb87ee779bb08

  • SHA256

    b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c

  • SHA512

    8f157f9814b9d48d9455545d9a27e2009f28080d12ecb140b00a47f508c3bd94ed8a93f2a2fe2e22a1b46a558c345fc5e85b1c2ed80d5d5672c4f00f6d70073e

  • SSDEEP

    12288:/n8yN0Mr8ZL6aVs7IypwXK4Qzh+jMlWCEh/yr5QE00vZ5McAA9YlO3d:vPuZLzIfpwiz0wy/ylQd0ccdYlO3d

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe
    "C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2732
    • C:\Users\Public\Microsoft Build\Isass.exe
      "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe
        "C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Users\Public\Microsoft Build\Isass.exe
          "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2604
          • C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe
            "C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe"
            5⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2664
            • C:\Users\Public\Microsoft Build\Isass.exe
              "C:\Users\Public\Microsoft Build\Isass.exe" Tablet C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2592
              • C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe
                "C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:2320
                • C:\Windows\Temp\{FE280BE1-F799-4513-BA0E-772820E4A95E}\.cr\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe
                  "C:\Windows\Temp\{FE280BE1-F799-4513-BA0E-772820E4A95E}\.cr\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\b6d4f162f5ae5e393b38a7b4530a148f667fefe09ba6eca65ffef29c0af1b47c.exe

    Filesize

    632KB

    MD5

    c27046bd35c5717084bb40c7305b941a

    SHA1

    51510a7753dd2a1236b34b495db21ef18a74c25c

    SHA256

    e0bc82c13bcd1ade084a0421dab88e23e9cc5499323449e585e7dd2116951bd3

    SHA512

    df9dc98043ea5b86c671e769a75e569366223c5a291f5eed22f68af9783a0aa295d8bb0ee0b510767cce7961f2e501124d9fe656044766644e18682f21446214

  • C:\Windows\Temp\{049A8F45-B7E0-4139-9254-64CB5CBE6741}\.ba\logo.png

    Filesize

    1KB

    MD5

    d6bd210f227442b3362493d046cea233

    SHA1

    ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

    SHA256

    335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

    SHA512

    464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

  • \Users\Public\Microsoft Build\Isass.exe

    Filesize

    216KB

    MD5

    4e3da62191c139e87d1f71984d949fce

    SHA1

    5c8b28ea57a97cbb166e4fbcc141844aad5f253f

    SHA256

    d01f00c25d0328aa0d4bfa21af570f1697a725f23cf7d3cbfb4fef6183bc42bc

    SHA512

    7ca61e187b25fb9afce445e4952091f1248d6e68ff08c1d00d32a9c681f653d4100628ab31c23285e85d2f0daaa523f47f8ca4d3ac4f18d2224ceec999a63b9e

  • \Windows\Temp\{049A8F45-B7E0-4139-9254-64CB5CBE6741}\.ba\wixstdba.dll

    Filesize

    191KB

    MD5

    eab9caf4277829abdf6223ec1efa0edd

    SHA1

    74862ecf349a9bedd32699f2a7a4e00b4727543d

    SHA256

    a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

    SHA512

    45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

  • memory/1444-8-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/1444-10-0x0000000004370000-0x0000000005619000-memory.dmp

    Filesize

    18.7MB

  • memory/1444-14-0x0000000004370000-0x0000000005619000-memory.dmp

    Filesize

    18.7MB

  • memory/1444-12-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2592-31-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2604-21-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2664-23-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-103-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-95-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-133-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-15-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-82-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-83-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-86-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-87-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-91-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-129-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-16-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/2732-104-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-110-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-111-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-119-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2732-120-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/2796-17-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB

  • memory/3024-19-0x0000000000400000-0x00000000016A8E52-memory.dmp

    Filesize

    18.7MB