Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
204s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 00:48 UTC
Behavioral task
behavioral1
Sample
737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe
Resource
win7-20221111-en
5 signatures
150 seconds
General
-
Target
737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe
-
Size
296KB
-
MD5
5ba8cdf6367a173f5ef5fec8f5cd3430
-
SHA1
b3b1c5066c5c01fa5ac70a62fc8182d8a17150ad
-
SHA256
737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50
-
SHA512
7f838eb27509429a6e90583d541713ae5119df4ee0450e191bf56f0a47562378b8eaa35f6e3a1fbd46f4d2a675d4c4fd8a73084a0357ec9734188ca9f59fae6d
-
SSDEEP
6144:zTqPRndIKCC0ef//uXltKc+LVsz9b8AO0fF/H9K:UdFeCXuLKcCVsz6O
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3740-135-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3740-137-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3740-138-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3740-139-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3740-140-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/3740-141-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3208 set thread context of 3740 3208 737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe 85 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3208 737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3208 wrote to memory of 3740 3208 737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe 85 PID 3208 wrote to memory of 3740 3208 737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe 85 PID 3208 wrote to memory of 3740 3208 737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe 85 PID 3208 wrote to memory of 3740 3208 737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe 85 PID 3208 wrote to memory of 3740 3208 737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe 85 PID 3208 wrote to memory of 3740 3208 737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe 85 PID 3208 wrote to memory of 3740 3208 737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe 85 PID 3208 wrote to memory of 3740 3208 737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe"C:\Users\Admin\AppData\Local\Temp\737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\737956c59435f3880f70ad0bdabd2cbcedb6cb70e70ed8dc7773cd6678953c50.exe/scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"2⤵PID:3740
-
Network
-
Remote address:8.8.8.8:53Request226.101.242.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesta.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpaIN PTRResponse
-
260 B 5
-
260 B 5
-
260 B 5
-
322 B 7
-
322 B 7
-
260 B 5
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7