Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/10/2024, 20:59

General

  • Target

    7a76ffc52008454a2ec6f185247fd241ee691f5d178aade7c30dc5e11444fc54N.exe

  • Size

    110KB

  • MD5

    c711a01b7bcbff772f9f8c1d75d7d870

  • SHA1

    f991023ce1bb683b6f75132facf15776fde442ae

  • SHA256

    7a76ffc52008454a2ec6f185247fd241ee691f5d178aade7c30dc5e11444fc54

  • SHA512

    dde2086feac57b4345a72ed1f265a5de413621a8215e1da74a044d9f68eaa3d2892009a15f25031939f725749634374784f73608341ada913b707f8b4f4dd47b

  • SSDEEP

    3072:ZWrKR8W9Mj6yhPyKfXtAGsKG3ERrjjNB3+IQODwO1yU/0:GjYKlAhUBVB3pQODH1yUc

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a76ffc52008454a2ec6f185247fd241ee691f5d178aade7c30dc5e11444fc54N.exe
    "C:\Users\Admin\AppData\Local\Temp\7a76ffc52008454a2ec6f185247fd241ee691f5d178aade7c30dc5e11444fc54N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

    Filesize

    408KB

    MD5

    5134d99509ee3e7fdea24b133c5fca87

    SHA1

    860e35e2aa59a439c1fc103542a9c8087913ee36

    SHA256

    55232313c58d860bb4cd1a2d4acda01ef7cb9e068196c3a28de38dbb7da1f336

    SHA512

    22f9521fa500b9b7b6d9568d4eb0da9dbd6d488fee457622a258d376255c4ac85fea830dea79ba30085f7000d23e59e3fe15cfb9c90923fb4ee2be05b1ea3efe

  • C:\Users\Admin\AppData\Local\Temp\iXeoKt7Br62YNAz.exe

    Filesize

    110KB

    MD5

    bebbd41f0e75c2f5a9886612ab0d69c6

    SHA1

    3efade209f569d3ce11486360f03dc067730ff81

    SHA256

    04e399b29ad6857c0e04ea1f10ad2350e45261e13cd4e9011de58c4d70ef0dbf

    SHA512

    7e25fe49ae7b77056f75cd20c459fede97a2211468e6258e4b9e8a9dfd3cdac5535a4caa6953ed1a547eb66d1845a2c9351722a055ba489f4ef44d2aef2328a4

  • C:\Windows\CTS.exe

    Filesize

    86KB

    MD5

    0f736d30fbdaebed364c4cd9f084e500

    SHA1

    d7e96b736463af4b3edacd5cc5525cb70c593334

    SHA256

    431b7f30b7f8d520f69066b03b8dccbb35a6cb40a53c5e2320c6b5acf96b2e34

    SHA512

    570a2f76d653414fedc12ed486f2bf0333dc860f52d70faa895d6b9951ac185317637d7b076e05c932f4c536259e19a952a716e9516d506d2a19de73c50f2566