Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    252s
  • max time network
    311s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/02/2023, 14:00

General

  • Target

    0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb.exe

  • Size

    185KB

  • MD5

    5b58c510d1b9aa6eb7973deac9e426b0

  • SHA1

    9944238f4a71a377608aa8dd8459167794acd035

  • SHA256

    0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb

  • SHA512

    6dde55d01f597dfb9e2b12d5c71446d54b27bc5787df5034cb9fbf9f0ca779c59d54eac1c8ec45731eef046c9aa7f3dd2fb6bbef21b8d44fb064d66be39a1c97

  • SSDEEP

    3072:fbsT7ek3OdH2cmCpf+LTaqj8iNnRLHh3JJWHhH17Qr1UZ9xA3:fbuvU2VCpGhEHwr1UZ9x

Malware Config

Signatures

  • Downloads MZ/PE file
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb.exe
    "C:\Users\Admin\AppData\Local\Temp\0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:3488

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3488-132-0x00000000007CE000-0x00000000007E1000-memory.dmp

    Filesize

    76KB

  • memory/3488-133-0x0000000000700000-0x0000000000715000-memory.dmp

    Filesize

    84KB

  • memory/3488-134-0x00000000007CE000-0x00000000007E1000-memory.dmp

    Filesize

    76KB

  • memory/3488-135-0x0000000000400000-0x0000000000628000-memory.dmp

    Filesize

    2.2MB

  • memory/3488-136-0x0000000000400000-0x0000000000628000-memory.dmp

    Filesize

    2.2MB

  • memory/3488-137-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB