Overview

overview

8

Static

static

Tray.exe

windows7_x64

8

Tray.exe

windows10_x64

8

Resubmissions

13/02/2022, 03:26

220213-dy59eafben 10

25/06/2021, 19:08

210625-fml1gypkn6 8

19/06/2021, 15:14

210619-d3391n953n 10

Analysis

  • max time kernel
    114s
  • max time network
    39s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    25/06/2021, 19:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Tray.exe

  • Size

    321KB

  • MD5

    6585cb51ff21007fb9ef936e96c58982

  • SHA1

    7a3d5563460b9935fe84879ee14fabfc7c664825

  • SHA256

    e07b0cd7eca5bc70b07ea786c3ef4da28036c901effa2193a93caf945cb2b334

  • SHA512

    523c7b3ed0907a473eac04c8cb8642eeea1d3a223069f876a7e0bc18075d59f9903319f6b2e3c2fa262158f04c4ad3637568dd9b0558732c8a574ffe566efc7d

Score
8/10
spywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 9 IoCs
  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 64 IoCs
  • Drops autorun.inf file 1 TTPs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Tray.exe
    "C:\Users\Admin\AppData\Local\Temp\Tray.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:1084
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1504

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1084-59-0x0000000001140000-0x0000000001141000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1084-61-0x0000000004E20000-0x0000000004E21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1504-62-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp

    Filesize

    8KB

    Download