Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24/04/2023, 08:00

General

  • Target

    bcb0712f7ce3fc39215bdd3af15404022cd58c0dd5ccb827590b8f34c9accacc.exe

  • Size

    104KB

  • MD5

    29561dfe6a23568553f23966d1fcaa51

  • SHA1

    f491a46e836c1a6887852334af4c6e89280493af

  • SHA256

    bcb0712f7ce3fc39215bdd3af15404022cd58c0dd5ccb827590b8f34c9accacc

  • SHA512

    c5c8189e752e4dbf452240c762c8e6391ad005832f3c9fcf23424932da74040a04d01334d7cec6770717f6348f4e6a0a3201ed98fbbaf3c7359fb10464da2615

  • SSDEEP

    1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG

Malware Config

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bcb0712f7ce3fc39215bdd3af15404022cd58c0dd5ccb827590b8f34c9accacc.exe
    "C:\Users\Admin\AppData\Local\Temp\bcb0712f7ce3fc39215bdd3af15404022cd58c0dd5ccb827590b8f34c9accacc.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • outlook_office_path
    • outlook_win_path
    PID:1304

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads