Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/11/2022, 23:08
Static task
static1
Behavioral task
behavioral1
Sample
b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe
Resource
win10v2004-20220812-en
General
-
Target
b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe
-
Size
815KB
-
MD5
6e8b468ea35cf4b766bdd8673e0dbae5
-
SHA1
306c216b2d463d28349f1d82ed055b9c730ab8a3
-
SHA256
b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4
-
SHA512
7f9292298c286e8a1fdeef5375a06a0e56785fa16eb67c59f3f5c7b4c77e0f02a36d04fd2bbcd1566a58de8193a9fed742124ddb7b3bff2bb9f52553bf7c864f
-
SSDEEP
24576:vHnM9Gxn5lf/n0HQIhaGYNt0TK2uIo2ma4:vHK65lfP07haGYNuTKH53
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1436-54-0x0000000000400000-0x000000000063D000-memory.dmp upx behavioral1/memory/1436-55-0x0000000000400000-0x000000000063D000-memory.dmp upx behavioral1/memory/1436-57-0x0000000000400000-0x000000000063D000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AmdAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe" b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe"C:\Users\Admin\AppData\Local\Temp\b20431da56d78c2c7bc658ce1e5bcbe4d736e187bdf96f289cc1c116cd1a6ac4.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
PID:1436