Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 20:35
Static task
static1
Behavioral task
behavioral1
Sample
21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe
Resource
win10v2004-20220812-en
General
-
Target
21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe
-
Size
816KB
-
MD5
907691aa62f98ba4be1105c78747fb78
-
SHA1
3d2a7f0b92687a927aceab371be71b063ec364af
-
SHA256
21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716
-
SHA512
cb9496e262f350fb50822e35b1941f43f63d5785dbc1dc5b062a4ab0c14322704ea1b554158404e693aca9b9fa5074ca3c0d95281251ce6a6bed6f6ff339c6cc
-
SSDEEP
24576:nGmzUOl+HFpyyvh6PG+vA9kjB+wyozhn1eXF/6H:GmzUOwlpyyj+DjB+Ch1AF/6
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4188-132-0x0000000000400000-0x00000000007A9000-memory.dmp upx behavioral2/memory/4188-134-0x0000000000400000-0x00000000007A9000-memory.dmp upx behavioral2/memory/4188-135-0x0000000000400000-0x00000000007A9000-memory.dmp upx behavioral2/memory/4188-136-0x0000000000400000-0x00000000007A9000-memory.dmp upx behavioral2/memory/4188-137-0x0000000000400000-0x00000000007A9000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\NetworkChecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe" 21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main 21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DefaultCompressedRecord = d580f97f730fb6ff2e0e1778c06a044f3ac83997e7d9f4a032a4bf3258a1c2bb239e57c95b74f059548860c36d08f5acc6692908d878e0c1f4972ede68d75a71f4d5d92a74b6c7881156aa067e970f4f2eb1bfdb18677fc3b5736acbf4427cd3972277917223f7 21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\RecordModifiedMax = "DNEQelDJxZ6xYIlr9fshR9+PDOujl80JGOwHMQiKd+niAFkkDt6uY1xe2YfE6Fgkpw==" 21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FlagsModifiedValid = 0000000000000000 21a184ce64ae6fe3c15127596118072a74d3c9764ed97d36035379415a169716.exe