Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
74s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 12:17
Static task
static1
Behavioral task
behavioral1
Sample
9e566704cc0072e3ebf6b496b40d80c3bf04aeeccd301feae75927b385e7fb33.exe
Resource
win7-20221111-en
General
-
Target
9e566704cc0072e3ebf6b496b40d80c3bf04aeeccd301feae75927b385e7fb33.exe
-
Size
961KB
-
MD5
b646f0e424b36cd7d383065a75a47473
-
SHA1
99df3129dacd2aec0e6c88c6064365f52c084b25
-
SHA256
9e566704cc0072e3ebf6b496b40d80c3bf04aeeccd301feae75927b385e7fb33
-
SHA512
41a056ca39933bad52b94cbd9191c0c1ee46f50e57f5995876bcef374f50ffdde2e74c51bd41db6ceff006cbfb333ad506e7e553e6e86f576df68540686aaf8c
-
SSDEEP
24576:ikQ1aOCco82PkHsddUplpYE+JglzGWqVgjsaxZiAvS5cSsS:r/co82CsrUplpYEZ1BjsEZyl
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1968 9e566704cc0072e3ebf6b496b40d80c3bf04aeeccd301feae75927b385e7fb33.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1968 9e566704cc0072e3ebf6b496b40d80c3bf04aeeccd301feae75927b385e7fb33.exe 1968 9e566704cc0072e3ebf6b496b40d80c3bf04aeeccd301feae75927b385e7fb33.exe 1968 9e566704cc0072e3ebf6b496b40d80c3bf04aeeccd301feae75927b385e7fb33.exe 1968 9e566704cc0072e3ebf6b496b40d80c3bf04aeeccd301feae75927b385e7fb33.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e566704cc0072e3ebf6b496b40d80c3bf04aeeccd301feae75927b385e7fb33.exe"C:\Users\Admin\AppData\Local\Temp\9e566704cc0072e3ebf6b496b40d80c3bf04aeeccd301feae75927b385e7fb33.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1968