Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 03:10
Static task
static1
Behavioral task
behavioral1
Sample
ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe
Resource
win7-20241010-en
General
-
Target
ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe
-
Size
4.1MB
-
MD5
5f333ec8f045aff195aad4311a4b7ef2
-
SHA1
99dd90fac17bedff9dfe1ad6c2d0a953758bd91b
-
SHA256
ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b
-
SHA512
d971ef26716279c02146ca4a877ff0360bed51a4817f81efff940cbaed80f348e45de17b722b6723d15af6bb2def3bac2bfbace62c2ff8bc480d6d500a120321
-
SSDEEP
98304:B9Njdz3gVVo8KPTFqhcDthVheU4CJl1zR1zzRqJ2trCyT:HLrl71nfeU4CrZzVqgt1T
Malware Config
Signatures
-
Cryptbot family
-
Detects CryptBot payload 1 IoCs
CryptBot is a C++ stealer distributed widely in bundle with other software.
resource yara_rule behavioral2/memory/4384-9-0x0000000069CC0000-0x000000006A71B000-memory.dmp family_cryptbot_v3 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe -
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 2920 chrome.exe 1064 chrome.exe 4964 chrome.exe 1736 chrome.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe -
Executes dropped EXE 3 IoCs
pid Process 1916 service123.exe 3888 service123.exe 3668 service123.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Wine ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe -
Loads dropped DLL 3 IoCs
pid Process 1916 service123.exe 3888 service123.exe 3668 service123.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4384 ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3660 4384 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2500 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4384 ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe 4384 ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe 1736 chrome.exe 1736 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe Token: SeShutdownPrivilege 1736 chrome.exe Token: SeCreatePagefilePrivilege 1736 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe 1736 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4384 wrote to memory of 1736 4384 ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe 95 PID 4384 wrote to memory of 1736 4384 ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe 95 PID 1736 wrote to memory of 3636 1736 chrome.exe 96 PID 1736 wrote to memory of 3636 1736 chrome.exe 96 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 1604 1736 chrome.exe 97 PID 1736 wrote to memory of 2896 1736 chrome.exe 98 PID 1736 wrote to memory of 2896 1736 chrome.exe 98 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99 PID 1736 wrote to memory of 4996 1736 chrome.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe"C:\Users\Admin\AppData\Local\Temp\ddc36ae51e0636472cbe7f04d0f4f3ae11a3f8efcdf8fd6068b0dc6eb614170b.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa383dcc40,0x7ffa383dcc4c,0x7ffa383dcc583⤵PID:3636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1960,i,4344705238626444571,9916972712824603909,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1956 /prefetch:23⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1832,i,4344705238626444571,9916972712824603909,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2116 /prefetch:33⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,4344705238626444571,9916972712824603909,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2432 /prefetch:83⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,4344705238626444571,9916972712824603909,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3176 /prefetch:13⤵
- Uses browser remote debugging
PID:2920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,4344705238626444571,9916972712824603909,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3216 /prefetch:13⤵
- Uses browser remote debugging
PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3872,i,4344705238626444571,9916972712824603909,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:13⤵
- Uses browser remote debugging
PID:4964
-
-
-
C:\Users\Admin\AppData\Local\Temp\service123.exe"C:\Users\Admin\AppData\Local\Temp\service123.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1916
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 14922⤵
- Program crash
PID:3660
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4384 -ip 43841⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3888
-
C:\Users\Admin\AppData\Local\Temp\service123.exeC:\Users\Admin\AppData\Local\Temp\/service123.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3668
Network
MITRE ATT&CK Enterprise v15
Persistence
Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD5568829554bc0f5f364f6b23123ba0cd1
SHA15f23ed943278278dd0f951e1ba31febc37304a0c
SHA256cadf4c9db3f8019e654a223b16049af1740fca3c038f8cc12f011fba08235c5b
SHA512fd20e85677efcfc12f156c3a0a70c5aacb34aa603162424e3a3e32b432ebba4164de48e4871667612076ca0a911049f096ecadae718498ec08a3d25a9b765cf4