Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

be993277e7...a8.exe

windows7-x64

10

be993277e7...a8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 06:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    be993277e71fd91453651b5960088c71cc430ff6750b8c73b56586d5203921a8.exe

  • Size

    214KB

  • MD5

    25364a4e054cbfe90968028b3de3dba0

  • SHA1

    8379182160adba00c2c84cc7c92146a54e1ceef9

  • SHA256

    be993277e71fd91453651b5960088c71cc430ff6750b8c73b56586d5203921a8

  • SHA512

    d24f8e0d7b01a0dd453fd51ebafd0b6cd1ac02e61b9019d19ce99b8757f3361850297aab4ec54b0190764b27d861e0e81a393b03067d5caf5b00dbe112ca071b

  • SSDEEP

    3072:ZSDuGtVVkJpJpkmMZSlYOUxALuiWGjolObzUtwp34d:2wJpJNYOUxku1GzzU24d

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    15800620204

Signatures

  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops file in Program Files directory 2 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\be993277e71fd91453651b5960088c71cc430ff6750b8c73b56586d5203921a8.exe
    "C:\Users\Admin\AppData\Local\Temp\be993277e71fd91453651b5960088c71cc430ff6750b8c73b56586d5203921a8.exe"
    1⤵
    • UAC bypass
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:924
    • C:\Windows\SysWOW64\REG.exe
      REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      2⤵
      • Disables RegEdit via registry modification
      • Modifies registry key
      PID:3568
    • C:\Windows\SysWOW64\REG.exe
      REG add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f
      2⤵
      • Modifies registry key
      PID:4320

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/924-133-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/924-134-0x00000000749B0000-0x0000000074F61000-memory.dmp

    Filesize

    5.7MB

    Download