Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    41s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 15:32

General

  • Target

    2365632155efb556cce74fa5a4d7b6f739f42d84394962f71b59a0949cdc4683.exe

  • Size

    1.0MB

  • MD5

    fcef9b2203602fc481d64cafc35b2098

  • SHA1

    5f8314038c77241bb24dc5aeb050c40dd4f8673f

  • SHA256

    2365632155efb556cce74fa5a4d7b6f739f42d84394962f71b59a0949cdc4683

  • SHA512

    87d7ba9f73184a293885b3853f888afdab88a5f2acc07f23e36ed2d8a4f34c8f706d186b12f906399dd1216f178d4d12af9fa2da96cd2c0920b7f39e8d27f73f

  • SSDEEP

    24576:+B8+mu4DXEz/XVsR0FJc78OhJBgRPflYm8CcP2FRGmbl+aoNt7x:+OgWe+EYmEaoNn

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2365632155efb556cce74fa5a4d7b6f739f42d84394962f71b59a0949cdc4683.exe
    "C:\Users\Admin\AppData\Local\Temp\2365632155efb556cce74fa5a4d7b6f739f42d84394962f71b59a0949cdc4683.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\2365632155efb556cce74fa5a4d7b6f739f42d84394962f71b59a0949cdc4683.exe
      "C:\Users\Admin\AppData\Local\Temp\2365632155efb556cce74fa5a4d7b6f739f42d84394962f71b59a0949cdc4683.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1120

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1120-54-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1120-55-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1120-57-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1120-59-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1120-61-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1120-63-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1120-65-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1120-68-0x0000000075291000-0x0000000075293000-memory.dmp

    Filesize

    8KB

  • memory/1120-69-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1120-70-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB

  • memory/1120-71-0x0000000000400000-0x00000000004F5000-memory.dmp

    Filesize

    980KB