Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 20:35
Static task
static1
Behavioral task
behavioral1
Sample
21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe
Resource
win10v2004-20220812-en
General
-
Target
21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe
-
Size
816KB
-
MD5
907691aa62f98ba4be1105c78747fb78
-
SHA1
3d2a7f0b92687a927aceab371be71b063ec364af
-
SHA256
21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716
-
SHA512
cb9496e262f350fb50822e35b1941f43f63d5785dbc1dc5b062a4ab0c14322704ea1b554158404e693aca9b9fa5074ca3c0d95281251ce6a6bed6f6ff339c6cc
-
SSDEEP
24576:nGmzUOl+HFpyyvh6PG+vA9kjB+wyozhn1eXF/6H:GmzUOwlpyyj+DjB+Ch1AF/6
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1720-54-0x0000000000400000-0x00000000007A9000-memory.dmp upx behavioral1/memory/1720-56-0x0000000000400000-0x00000000007A9000-memory.dmp upx behavioral1/memory/1720-58-0x0000000000400000-0x00000000007A9000-memory.dmp upx behavioral1/memory/1720-59-0x0000000000400000-0x00000000007A9000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe" 21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.