Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2022, 05:40

General

  • Target

    ef52243546e684a7d8e628fa282f137350bfa2e21ad3b72cc8faea2e57e286b4.exe

  • Size

    1.4MB

  • MD5

    6aa8ddaec3cd4e60a68565c6726a82a5

  • SHA1

    f1cd1d51e093f3a3331821e793b3639c56eb49ae

  • SHA256

    ef52243546e684a7d8e628fa282f137350bfa2e21ad3b72cc8faea2e57e286b4

  • SHA512

    f22ad3e9a4ffecb59eadcf10e5b88314c3e0dfcd187bd0f695120853fec0655d0f635585b09d5c1af6f11fc5b11edd729f651c86e24fc8d03ee7ee8c39cabd46

  • SSDEEP

    24576:nD8UIjWviElDsDAxCrygijIciB5hPIyGAs42Pu:ngUICKWDsDAl38ciB5NIyGM22

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef52243546e684a7d8e628fa282f137350bfa2e21ad3b72cc8faea2e57e286b4.exe
    "C:\Users\Admin\AppData\Local\Temp\ef52243546e684a7d8e628fa282f137350bfa2e21ad3b72cc8faea2e57e286b4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Internet Explorer settings
    PID:4380

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4380-132-0x0000000000400000-0x000000000063E000-memory.dmp

    Filesize

    2.2MB

  • memory/4380-133-0x0000000000400000-0x000000000063E000-memory.dmp

    Filesize

    2.2MB