Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
223s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30/11/2022, 16:43
Behavioral task
behavioral1
Sample
3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa.exe
Resource
win7-20221111-en
General
-
Target
3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa.exe
-
Size
1.1MB
-
MD5
9737f768f5539cb2a0853f265e4c32a1
-
SHA1
e91bac502e203094878457a58a70aa0261bc6322
-
SHA256
3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa
-
SHA512
6fbcd5ab193fd7a9193238b031e1efef8efae52d6d24f011bd0420baffe6b330c126f5315bc6d20ff50186ec175910db93ef9c41a187e20aa1d4b36b55e6df22
-
SSDEEP
24576:hbIQ9iBHtWkOLTBDNSl6nNoYOmubsdI5oansjqFJaN0cKKwt:Z9ibiTBDNXTJjqFDc9w
Malware Config
Extracted
ffdroider
http://101.36.107.74
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 1260 3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa.exe