Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    110s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • submitted
    25/07/2022, 06:01

General

  • Target

    560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f.exe

  • Size

    488KB

  • MD5

    e5770e11e313cb8802bbf0e001f49ee9

  • SHA1

    94f88a6d416036a4d2cb155774ec0c1f70473a02

  • SHA256

    560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

  • SHA512

    a766e7863c09a145259c17e7d9c6f3065567ba96e9c527ffb9fb23bd7b216f6c537b81a678cc14877ccfee6279fd4055adce1f9fe8ff9e7207ac4dd05bd75cd1

  • SSDEEP

    12288:Ivp+HbZN4SZaOdRrtr/5C4THvWDzVlJCSk6w:6puZPZaOdRrpCD5mSvw

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Signatures

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f.exe
    "C:\Users\Admin\AppData\Local\Temp\560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1408

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1408-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

    Filesize

    8KB

  • memory/1408-55-0x0000000000400000-0x000000000051B000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-56-0x0000000000400000-0x000000000051B000-memory.dmp

    Filesize

    1.1MB

  • memory/1408-57-0x0000000002470000-0x0000000002480000-memory.dmp

    Filesize

    64KB

  • memory/1408-63-0x0000000002D60000-0x0000000002D70000-memory.dmp

    Filesize

    64KB

  • memory/1408-69-0x0000000000400000-0x000000000051B000-memory.dmp

    Filesize

    1.1MB