Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/04/2023, 23:02
230406-21d5pshe5w 1006/04/2023, 23:02
230406-21dh6she5v 1013/03/2023, 11:49
230313-nzf11scc6x 630/09/2020, 14:54
200930-e89nxyvp4s 6Analysis
-
max time kernel
150s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
06/04/2023, 23:02
General
-
Target
adjkd88450.exe
-
Size
11.7MB
-
MD5
ea4dcce5d2cb8016c243da411d072016
-
SHA1
e56f839a6a5f344f8398dc79a0f0f0e1a2be72e0
-
SHA256
fa081a6c89433b571eb2755f1867108eb457ee81a145cd39870647a6d402134e
-
SHA512
831b3f32a6badae1eef1b5fdff07f452e21ee2f9ad54babcb50171bcbb95de7d7273feaae2b7b9fe26fc50163325e3000e9967573d33e0e4cc3a345705ff3807
-
SSDEEP
49152:sPv6gIcjjXfzMiptpyTpVP5fFHjADRamoCbdsS/Fj4YSIGIIX/KAph65R7/tY3Uj:sXZdYiwFyz3TFD53qe
Malware Config
Signatures
-
Detects Grandoreiro payload 9 IoCs
-
Grandoreiro
Part of a group of banking trojans, targeting Spanish and Portuguese speaking countries.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\adjkd88450.exe"C:\Users\Admin\AppData\Local\Temp\adjkd88450.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
11.8MB
-
Filesize
11.8MB
-
Filesize
11.8MB
-
Filesize
11.8MB
-
Filesize
11.8MB
-
Filesize
11.8MB
-
Filesize
11.8MB
-
Filesize
11.8MB
-
Filesize
11.8MB