Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
252s -
max time network
311s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
09/02/2023, 14:00
Static task
static1
General
-
Target
0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb.exe
-
Size
185KB
-
MD5
5b58c510d1b9aa6eb7973deac9e426b0
-
SHA1
9944238f4a71a377608aa8dd8459167794acd035
-
SHA256
0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb
-
SHA512
6dde55d01f597dfb9e2b12d5c71446d54b27bc5787df5034cb9fbf9f0ca779c59d54eac1c8ec45731eef046c9aa7f3dd2fb6bbef21b8d44fb064d66be39a1c97
-
SSDEEP
3072:fbsT7ek3OdH2cmCpf+LTaqj8iNnRLHh3JJWHhH17Qr1UZ9xA3:fbuvU2VCpGhEHwr1UZ9x
Malware Config
Signatures
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3488 0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb.exe 3488 0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb.exe"C:\Users\Admin\AppData\Local\Temp\0699e4e73c97a7d4a0e2e84dbd8fadc155971235f077994d3d6bab9d526db9bb.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3488