1132a9355ab5ae76e66aba3d8286d24a3e406b04663894a07fc4043aaa0e24da | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1132a9355a...da.exe

windows7-x64

8

1132a9355a...da.exe

windows10-2004-x64

8

Sharing

General

Target

1132a9355ab5ae76e66aba3d8286d24a3e406b04663894a07fc4043aaa0e24da
Size

313KB
Sample

221002-rzdsfaahd9
MD5

6e0cd26e72297a5247a36c1cc3e2b397
SHA1

d49ed31879ead03619c2fefaf55d39ee482d8c1f
SHA256

1132a9355ab5ae76e66aba3d8286d24a3e406b04663894a07fc4043aaa0e24da
SHA512

43b4c8fe18d888ee65fc0d8258428a5085817851492ed8f3ace790a3677fc97f124206a4ea80498cc3cdee9e91223b8314c4c58423125c25f28629589dcab6f6
SSDEEP

6144:91OgDPdkBAFZWjadD4sURG5oqmv3K6bVBkSDCOSLjyzs4bgvdmVY:91OgLdaxOoqs3K6bXCBLjXp

Score

8^/10

adware discovery spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

1132a9355ab5ae76e66aba3d8286d24a3e406b04663894a07fc4043aaa0e24da.exe

Resource

win7-20220812-en

adware discovery spyware stealer

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

1132a9355ab5ae76e66aba3d8286d24a3e406b04663894a07fc4043aaa0e24da.exe

Resource

win10v2004-20220901-en

adware discovery spyware stealer

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  1132a9355ab5ae76e66aba3d8286d24a3e406b04663894a07fc4043aaa0e24da
- Size
  
  313KB
- MD5
  
  6e0cd26e72297a5247a36c1cc3e2b397
- SHA1
  
  d49ed31879ead03619c2fefaf55d39ee482d8c1f
- SHA256
  
  1132a9355ab5ae76e66aba3d8286d24a3e406b04663894a07fc4043aaa0e24da
- SHA512
  
  43b4c8fe18d888ee65fc0d8258428a5085817851492ed8f3ace790a3677fc97f124206a4ea80498cc3cdee9e91223b8314c4c58423125c25f28629589dcab6f6
- SSDEEP
  
  6144:91OgDPdkBAFZWjadD4sURG5oqmv3K6bVBkSDCOSLjyzs4bgvdmVY:91OgLdaxOoqs3K6bXCBLjXp
Score

8^/10

adware discovery spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarediscoveryspywarestealer

behavioral2

adwarediscoveryspywarestealer

© 2018-2025

Terms | Privacy