Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2022, 16:43
Behavioral task
behavioral1
Sample
3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa.exe
Resource
win7-20221111-en
General
-
Target
3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa.exe
-
Size
1.1MB
-
MD5
9737f768f5539cb2a0853f265e4c32a1
-
SHA1
e91bac502e203094878457a58a70aa0261bc6322
-
SHA256
3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa
-
SHA512
6fbcd5ab193fd7a9193238b031e1efef8efae52d6d24f011bd0420baffe6b330c126f5315bc6d20ff50186ec175910db93ef9c41a187e20aa1d4b36b55e6df22
-
SSDEEP
24576:hbIQ9iBHtWkOLTBDNSl6nNoYOmubsdI5oansjqFJaN0cKKwt:Z9ibiTBDNXTJjqFDc9w
Malware Config
Extracted
ffdroider
http://101.36.107.74
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 4616 3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa.exe"C:\Users\Admin\AppData\Local\Temp\3ecdf68050037397581c45131bfc498c245bb4f81b484ce05454739ef56e84aa.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4616 -ip 46161⤵PID:2928