Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2023, 18:16

General

  • Target

    BANCO HSBC PAGO EXITOSO FECHA VALOR 16 AGOSTO 2023.exe

  • Size

    668KB

  • MD5

    a9a44220f7819f03d7b8474033b169ee

  • SHA1

    0f0bf5382702736838907fd65e5dd7e50616f305

  • SHA256

    1f3138026ba3af1ba357d822d95ef957d2661426ab28a7203263d8239b63dafa

  • SHA512

    255bc358ad925873d382461ad5000f9f55d96c10751a5c682882cee61e363dbbbba2eb405c91ab3ae12df343e84ce9bf04f0e866846317e5ac5288e9d9eb549b

  • SSDEEP

    12288:O3uLTTe2xpDl+C2wVWxDGbec0r3g5Lp/Q8sBB/nVP3FHHCNzNui9neZrgOV8:YoTZR4DGH0r3gRp/vipn3CNMhrg

Score
7/10

Malware Config

Signatures

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BANCO HSBC PAGO EXITOSO FECHA VALOR 16 AGOSTO 2023.exe
    "C:\Users\Admin\AppData\Local\Temp\BANCO HSBC PAGO EXITOSO FECHA VALOR 16 AGOSTO 2023.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\Temp\BANCO HSBC PAGO EXITOSO FECHA VALOR 16 AGOSTO 2023.exe
      "C:\Users\Admin\AppData\Local\Temp\BANCO HSBC PAGO EXITOSO FECHA VALOR 16 AGOSTO 2023.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BANCO HSBC PAGO EXITOSO FECHA VALOR 16 AGOSTO 2023.exe.log

    Filesize

    1KB

    MD5

    6dcfdb496c3cf0a736b09292618b380d

    SHA1

    59d3aecbd319c9b48d500b51a093ee48d02af334

    SHA256

    cb5dcf594045c8b7a5f87e8a12eabbd3e53e673654926027627ed79ef3e2a203

    SHA512

    9b7d22dc9e40d11693f7191f7b075a78974322af145010e66b19d989e678477dfe4741e88d02929d5b37236276f4605bc23a7adbedf43b66cd3c4e5e7b7e67ff

  • memory/4056-142-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/4056-151-0x00000000059B0000-0x00000000059C0000-memory.dmp

    Filesize

    64KB

  • memory/4056-150-0x0000000075360000-0x0000000075B10000-memory.dmp

    Filesize

    7.7MB

  • memory/4056-149-0x0000000007040000-0x0000000007090000-memory.dmp

    Filesize

    320KB

  • memory/4056-148-0x00000000059C0000-0x0000000005A26000-memory.dmp

    Filesize

    408KB

  • memory/4056-147-0x00000000059B0000-0x00000000059C0000-memory.dmp

    Filesize

    64KB

  • memory/4056-145-0x0000000075360000-0x0000000075B10000-memory.dmp

    Filesize

    7.7MB

  • memory/5068-141-0x0000000009820000-0x00000000098BC000-memory.dmp

    Filesize

    624KB

  • memory/5068-134-0x0000000075360000-0x0000000075B10000-memory.dmp

    Filesize

    7.7MB

  • memory/5068-140-0x0000000005040000-0x0000000005050000-memory.dmp

    Filesize

    64KB

  • memory/5068-139-0x0000000075360000-0x0000000075B10000-memory.dmp

    Filesize

    7.7MB

  • memory/5068-146-0x0000000075360000-0x0000000075B10000-memory.dmp

    Filesize

    7.7MB

  • memory/5068-138-0x0000000005130000-0x000000000513A000-memory.dmp

    Filesize

    40KB

  • memory/5068-137-0x0000000005040000-0x0000000005050000-memory.dmp

    Filesize

    64KB

  • memory/5068-136-0x0000000005060000-0x00000000050F2000-memory.dmp

    Filesize

    584KB

  • memory/5068-135-0x0000000005510000-0x0000000005AB4000-memory.dmp

    Filesize

    5.6MB

  • memory/5068-133-0x00000000005E0000-0x000000000068C000-memory.dmp

    Filesize

    688KB