Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    25/10/2024, 20:59

General

  • Target

    7a76ffc52008454a2ec6f185247fd241ee691f5d178aade7c30dc5e11444fc54N.exe

  • Size

    110KB

  • MD5

    c711a01b7bcbff772f9f8c1d75d7d870

  • SHA1

    f991023ce1bb683b6f75132facf15776fde442ae

  • SHA256

    7a76ffc52008454a2ec6f185247fd241ee691f5d178aade7c30dc5e11444fc54

  • SHA512

    dde2086feac57b4345a72ed1f265a5de413621a8215e1da74a044d9f68eaa3d2892009a15f25031939f725749634374784f73608341ada913b707f8b4f4dd47b

  • SSDEEP

    3072:ZWrKR8W9Mj6yhPyKfXtAGsKG3ERrjjNB3+IQODwO1yU/0:GjYKlAhUBVB3pQODH1yUc

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a76ffc52008454a2ec6f185247fd241ee691f5d178aade7c30dc5e11444fc54N.exe
    "C:\Users\Admin\AppData\Local\Temp\7a76ffc52008454a2ec6f185247fd241ee691f5d178aade7c30dc5e11444fc54N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nYcRniIN7M4qloM.exe

    Filesize

    24KB

    MD5

    085ebd119f5fc6b8f63720fac1166ff5

    SHA1

    af066018aadec31b8e70a124a158736aca897306

    SHA256

    b8411fe8ec499074fca9047f6983d920279e84ddf3b02b2dd5c08cf07ec44687

    SHA512

    adb0522830db26123347cb485c43b156f5c888510e52091ba0fafc22b650ad29630c027746c920321905c28259dce7ff63dded93a79efddd5567c68312117875

  • C:\Windows\CTS.exe

    Filesize

    86KB

    MD5

    0f736d30fbdaebed364c4cd9f084e500

    SHA1

    d7e96b736463af4b3edacd5cc5525cb70c593334

    SHA256

    431b7f30b7f8d520f69066b03b8dccbb35a6cb40a53c5e2320c6b5acf96b2e34

    SHA512

    570a2f76d653414fedc12ed486f2bf0333dc860f52d70faa895d6b9951ac185317637d7b076e05c932f4c536259e19a952a716e9516d506d2a19de73c50f2566