Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
330s -
max time network
360s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
06/12/2022, 01:37
General
-
Target
ba242180ebad14656b66c630661370a02e5ae1bb1dd2d411748e1de849e7e7da.exe
-
Size
93KB
-
MD5
234389196e67b104fedfde394e2acada
-
SHA1
7491b5ee5cc66e9e582d42e4effe10093f3fd3cf
-
SHA256
ba242180ebad14656b66c630661370a02e5ae1bb1dd2d411748e1de849e7e7da
-
SHA512
b49d94009390ea140a1173a95f3955e228a056619f1736f15c043cc348cfa277873bd467062c4a5488863a4af0c75e1eec2e8caac97a5115e106d561b17f2c38
-
SSDEEP
1536:RZcWsPsu7eBUSpikR3/yL3BtgPFmZ6XJfRRSfJ+GuSackiL:RZcAZHikB/ywPFmZGJfWJOB1
Malware Config
Signatures
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba242180ebad14656b66c630661370a02e5ae1bb1dd2d411748e1de849e7e7da.exe"C:\Users\Admin\AppData\Local\Temp\ba242180ebad14656b66c630661370a02e5ae1bb1dd2d411748e1de849e7e7da.exe"1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
188KB
-
Filesize
1024KB