Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
37s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
12/10/2022, 17:09
General
-
Target
090390c056a8ede941bd4f6bf3a3d3f631688fd34b9b14cb9941cd1525030eb8.exe
-
Size
533KB
-
MD5
60bf216bd89b6faeb8f52aa8b73b4e08
-
SHA1
85795a51b062861f11e059a97aaf5fa46e9e68d3
-
SHA256
090390c056a8ede941bd4f6bf3a3d3f631688fd34b9b14cb9941cd1525030eb8
-
SHA512
d550e091b7853d9557c18750d5e10342efc2c731db7d56a71421d29934f8c205490bfdc624b8a9bb45072be0618a1077d7ed1614b73f9c6fb74decd9e8ae7c80
-
SSDEEP
12288:gXsVa0LWyNkUK8drvf+5pnFYGq6O881MS+Nkz1hH3F1T:WmW7oNO5pFYyO88KRO1J
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\090390c056a8ede941bd4f6bf3a3d3f631688fd34b9b14cb9941cd1525030eb8.exe"C:\Users\Admin\AppData\Local\Temp\090390c056a8ede941bd4f6bf3a3d3f631688fd34b9b14cb9941cd1525030eb8.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Xenocode\Sandbox\1.0.0.0\2011.08.15T21.55\Virtual\STUBEXE\@APPDATALOCAL@\Temp\kar.exe"C:\Users\Admin\AppData\Local\Temp\kar.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5ee3ac6f4f5e134ea31f6a0e65c1c210c
SHA168af40f0e524e3583913286bcc91b75e6ebc9c10
SHA256ee8b196b526366dc8a4372e90be9f63cec1d037e47083fb0ed981b942d3848c5
SHA51291cb3ad70a2d6408a78763f2af0a6b0ffc0448f0f7357b7fe5fe061e13712ea11da8d4c2b4c0d01ba8c7ffef8255022ed41cb3e599ba0780f7b41a0e0514ffe0
-
Filesize
17KB
MD5ee3ac6f4f5e134ea31f6a0e65c1c210c
SHA168af40f0e524e3583913286bcc91b75e6ebc9c10
SHA256ee8b196b526366dc8a4372e90be9f63cec1d037e47083fb0ed981b942d3848c5
SHA51291cb3ad70a2d6408a78763f2af0a6b0ffc0448f0f7357b7fe5fe061e13712ea11da8d4c2b4c0d01ba8c7ffef8255022ed41cb3e599ba0780f7b41a0e0514ffe0
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
8KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
8KB
-
Filesize
352KB
-
Filesize
432KB
-
Filesize
352KB