Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    63s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 09:38

General

  • Target

    af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe

  • Size

    1.5MB

  • MD5

    7f7b975c1658fe0fc6d7913f1bdd08a7

  • SHA1

    45ccf2ad1260883df7d14df36b47f47b32ffc480

  • SHA256

    af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c

  • SHA512

    7f1fa7a52b7d3821b1cdc1e3b7eda0744040018fa06a40ed2e99b9b2d83b28afabb7f111be8c1470c4cb408323d875e594b8f9346fd36486088c3567364d795b

  • SSDEEP

    24576:tmpzgGd5UyylnSF99NfqLi+gJmssUZpwEi5nLwrFqznNM:IplDlmBvPp5nLwrFinNM

Score
10/10

Malware Config

Signatures

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe
    "C:\Users\Admin\AppData\Local\Temp\af8d3488f30527e942d0022e7c6fcd87e47f43f956a1ea51cf1aa32544175b5c.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 680
      2⤵
      • Program crash
      PID:1852

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1740-54-0x0000000076531000-0x0000000076533000-memory.dmp

    Filesize

    8KB