Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/10/2024, 21:28

General

  • Target

    4b565c155e0f9ca1d78d468b77fcc2aaae6121c701405cb90ad3336dc3409f2f.exe

  • Size

    99KB

  • MD5

    adec1dee6304a5f5320fc296aa4790da

  • SHA1

    2c5c00ce1759d15190a1be21da0f319212657bb7

  • SHA256

    4b565c155e0f9ca1d78d468b77fcc2aaae6121c701405cb90ad3336dc3409f2f

  • SHA512

    45faff55f35bc10ed253a40164c38b1f86f0540f0a64cc84382669a54fce4834465be4a3f5d09b015ccd2c5f028ab4e78de61d8c8fa41a6c5da1b2fe7ed04550

  • SSDEEP

    3072:ZWrKR8W9Mj6yhPyKfXtAGsKG3ERrjjNB3+IQORDu+:GjYKlAhUBVB3pQOB7

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b565c155e0f9ca1d78d468b77fcc2aaae6121c701405cb90ad3336dc3409f2f.exe
    "C:\Users\Admin\AppData\Local\Temp\4b565c155e0f9ca1d78d468b77fcc2aaae6121c701405cb90ad3336dc3409f2f.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3088
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    410KB

    MD5

    2815405a95070b2a792572d3470b8ff5

    SHA1

    89b125232a6e516edf80c770148f704907d20e81

    SHA256

    0219e2ed0a83c326fa65190d1d1a9a08c453555fd9ffdb89d4ed92e1ad0eaa76

    SHA512

    53f668f2774dff225a13c53ff651691696ae871df4155516f5e0abde6c1bc1a5427934ecc365cce8f0093f0bc5d507a7cec9e28daa77e0229eace1a2e1e817ef

  • C:\Users\Admin\AppData\Local\Temp\lCpPmRLSnzy0w1h.exe

    Filesize

    99KB

    MD5

    76595cee66699aaf3ba16728c85cd4db

    SHA1

    2c29f52271367c16b3b8c0abe5bca5c9267d953c

    SHA256

    f9667fe188ded8fdaa8ad943c09db58ec28962672df1129fc2b66d972299e89d

    SHA512

    6d22f0ffa55bd1d4b524d719d73fae3bfd653fdb1b37388d6e3d8ce2e22d4f65c07072bde0806d4c0001b7f2f516b25a01d66735de06ae2e6b747609271fbd3a

  • C:\Windows\CTS.exe

    Filesize

    86KB

    MD5

    0f736d30fbdaebed364c4cd9f084e500

    SHA1

    d7e96b736463af4b3edacd5cc5525cb70c593334

    SHA256

    431b7f30b7f8d520f69066b03b8dccbb35a6cb40a53c5e2320c6b5acf96b2e34

    SHA512

    570a2f76d653414fedc12ed486f2bf0333dc860f52d70faa895d6b9951ac185317637d7b076e05c932f4c536259e19a952a716e9516d506d2a19de73c50f2566