Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 10:30

General

  • Target

    fca30540d1feb531e3acc347d9749784ed9c33c694db22e6c91c10e68b78e263.exe

  • Size

    928KB

  • MD5

    8a8799dd9c61f681dd309062fe10907f

  • SHA1

    0cf8350fd20fd50eb4d762759af596f043e0bc1b

  • SHA256

    fca30540d1feb531e3acc347d9749784ed9c33c694db22e6c91c10e68b78e263

  • SHA512

    31526df89ae2fa785e322264c9eb40627e2d257211fac1d0ed25c3a2c890c326a1b7cb4c5816442b430273e014a2ea12e013d3bcebf93bc21f4bbfc3ad5b9796

  • SSDEEP

    24576:RUrYhmqvbAqd0bWbZr64BoHLqMia5VqE:qwvBdMWVr6VrqHa5VqE

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fca30540d1feb531e3acc347d9749784ed9c33c694db22e6c91c10e68b78e263.exe
    "C:\Users\Admin\AppData\Local\Temp\fca30540d1feb531e3acc347d9749784ed9c33c694db22e6c91c10e68b78e263.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Adds Run key to start application
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    PID:1640

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1640-132-0x0000000001210000-0x0000000001221000-memory.dmp

    Filesize

    68KB

  • memory/1640-133-0x00000000008E0000-0x0000000000A86000-memory.dmp

    Filesize

    1.6MB

  • memory/1640-134-0x0000000001210000-0x000000000128A000-memory.dmp

    Filesize

    488KB

  • memory/1640-135-0x0000000001210000-0x000000000128A000-memory.dmp

    Filesize

    488KB

  • memory/1640-136-0x00000000008E0000-0x0000000000A86000-memory.dmp

    Filesize

    1.6MB

  • memory/1640-137-0x0000000001210000-0x000000000128A000-memory.dmp

    Filesize

    488KB

  • memory/1640-138-0x0000000001210000-0x000000000128A000-memory.dmp

    Filesize

    488KB

  • memory/1640-139-0x00000000008E0000-0x0000000000A86000-memory.dmp

    Filesize

    1.6MB

  • memory/1640-140-0x00000000008E0000-0x0000000000A86000-memory.dmp

    Filesize

    1.6MB