Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
20/08/2023, 04:36
General
-
Target
a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4.exe
-
Size
7.3MB
-
MD5
f80dadc61dd4a914ce96139252df0aba
-
SHA1
ad8785e358f14f80083ca386b9505fbfa066c4b4
-
SHA256
a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4
-
SHA512
084a10db94dedf772f6ac6b964f13c0279b7fddcaadd69187ca50d994a7a83b143d02d3b5d0cd9c9102b34b5ef7f48a5db355cd97eddfb6e28ae22e3433f963e
-
SSDEEP
196608:H+23b3ntL9L2M8VKXGqIeP3ljBBFNzi3RPKLxhnZKW:H1Xd9L2M8VcIe1jARPKLxhnQW
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 6 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 1 IoCs
-
Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4.exe"C:\Users\Admin\AppData\Local\Temp\a9a6ae77b932e1628624f62af917e2487e1db8d318be8466e0c41adf5c79f0b4.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\BinGo\xthnetvm.exe"C:\Users\Admin\Documents\BinGo\xthnetvm.exe" rest2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\BinGo\runes\7z.exeC:\Users\Admin\Documents\BinGo\runes\7z.exe x "C:\Users\Admin\Documents\BinGo\runes\\13.16.1-v1692500306000.tgz" -y -p -o"C:\Users\Admin\Documents\BinGo\runes\"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\BinGo\runes\7z.exeC:\Users\Admin\Documents\BinGo\runes\7z.exe x "C:\Users\Admin\Documents\BinGo\runes\\13.16.1-v1692500306000.tar" -y -p -o"C:\Users\Admin\Documents\BinGo\runes\"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\BinGo\runes\7z.exeC:\Users\Admin\Documents\BinGo\runes\7z.exe x "C:\Users\Admin\Documents\BinGo\runes\\13.16.1-v1692500306000.tgz" -y -p -o"C:\Users\Admin\Documents\BinGo\runes\"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Documents\BinGo\runes\7z.exeC:\Users\Admin\Documents\BinGo\runes\7z.exe x "C:\Users\Admin\Documents\BinGo\runes\\13.16.1-v1692500306000.tar" -y -p -o"C:\Users\Admin\Documents\BinGo\runes\"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x504 0x24c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51a8c56bb96a15e18ad406a35edcc920e
SHA196532915a2c7ac86a99f845b785d0364e82d5f53
SHA256083fd1202169a70188813d7b51644a73367f2034e2e776e879a24bab043cd266
SHA512ae2a6efeab1a8cd3665affeb7281d27bed8329a9de571f56abf9a1d0ac2c691288c12029b33ef504aeaded900755f6d240188b039ce622cf428873ecb03a516b
-
Filesize
1.8MB
MD56fa08b52d88e7a4967764e099d33663b
SHA106d10ed3766bbaf56c7b6cb23821706dbadc025c
SHA256e295b243ae3e45289b8bfaff537d99ca7039d08a48c4359294dacd753936a0c0
SHA51214f21a29b1c69d82a4f00b9709549c996ab21a9f00e3bd553482110b93418a3c47fccee4cb2ad99f7213906c746a578c051e88b08f6cc3c2ac5ee8fe0a1b1bb0
-
Filesize
673KB
MD5c56b9e4c865fe1d28adec521600a0003
SHA121f71a5f95827a406223dce2a0226b03b7768d76
SHA25623774bd5dcd902b57572da10fd1eef676ee578dbcc543e063def3daae415b592
SHA512ce2fde4012f04d6146110957e6df761027728e3f066c0ee99f1a333ebe1960764116f48b89e3f8fcc9ed01117cb9947f23d69c73d4ff6e5b496ffc2cbfddfe85
-
Filesize
550KB
MD546d8b7d28fe3316385c6e16b2cbb5327
SHA10602d8a5abf32a12c3085570fb6ecab9cf4062bc
SHA2565d8f9e336740488ad27b06c9eff4051cc2a5f62458b75b423a4383b7995d9412
SHA5125f5f842470737a331231ec705cb0dbf1360448f36e6572d0e8177fa2cc9e894e3e2020c4399a57498ae82208f31a2ba4b58d2e394deffbf35f1e17ebe8d2a4ea
-
Filesize
54KB
MD5411423301601a7f63641a0879c25137d
SHA1293cf0dc82bc67bc9d963773ba634737fbc64da8
SHA256c3624b81d0889821978fe0e01544a2f56cae892187facda4b181735948cb383a
SHA512d75477976b16d59737f66629bfcefc26e4fdf4a041be50bd6d8501ee89fb2255c84a47b559a8cfc78cd0b775ecc355a128a9a3fae792eb99ed233af75955bc36
-
Filesize
41KB
MD549a1818298089983ddd60429a9973244
SHA1fb607cb81f1c68dfd00629a5ec593ae1f8c690cc
SHA25625cdd76451c2d0b1964a121fef788a32f9f375aea9c812bdf16a859ada616e47
SHA512604614210e57755be1845537e95d36f1cc1fbbdc3041d52bd86e8c85422888221f2c63d4e8b0d82207cd2c297fafc03b8f2804ba201b166554a43733eeda14b0
-
Filesize
354KB
MD51f0f641a53fe1535da96c6830ce20688
SHA1247fd5f4ea18f3dbada32784d89c58f9ecb287db
SHA2562151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744
SHA5123734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3
-
Filesize
354KB
MD51f0f641a53fe1535da96c6830ce20688
SHA1247fd5f4ea18f3dbada32784d89c58f9ecb287db
SHA2562151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744
SHA5123734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3
-
Filesize
354KB
MD51f0f641a53fe1535da96c6830ce20688
SHA1247fd5f4ea18f3dbada32784d89c58f9ecb287db
SHA2562151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744
SHA5123734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3
-
Filesize
354KB
MD51f0f641a53fe1535da96c6830ce20688
SHA1247fd5f4ea18f3dbada32784d89c58f9ecb287db
SHA2562151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744
SHA5123734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3
-
Filesize
354KB
MD51f0f641a53fe1535da96c6830ce20688
SHA1247fd5f4ea18f3dbada32784d89c58f9ecb287db
SHA2562151c021ec07eb8d2c1c08c884038e6606d8254d47e436f77fdf8be008891744
SHA5123734dff5c4af534afc634daf2df14207c6d6b0280ab7e731aaff7e9722aed226682c531934e85fa8bca35b5a8aa24640418ffcaa52124f7bbd26f01d168305f3
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
12.8MB
-
Filesize
12.8MB
-
Filesize
12.8MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12.8MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
12.8MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
860KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
860KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
12.8MB
-
Filesize
12.8MB
-
Filesize
12.8MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
12.8MB
-
Filesize
12.8MB
-
Filesize
1.1MB