Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 19:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ea53efe7909227d8d1c3b96df3f2194947459d09d6168e629dd1d089b3a9c42_JC.exe
Resource
win7-20230831-en
1 signatures
150 seconds
General
-
Target
7ea53efe7909227d8d1c3b96df3f2194947459d09d6168e629dd1d089b3a9c42_JC.exe
-
Size
309KB
-
MD5
84e957df7e77de3f3899e20e49207cf2
-
SHA1
7aed17df6078a860b3eb8339390238ce8830067b
-
SHA256
7ea53efe7909227d8d1c3b96df3f2194947459d09d6168e629dd1d089b3a9c42
-
SHA512
836f470e99d71c37c380994be7b279d4a2432be1ef804f39ac76acff09277768f0983a428f1a7f465cd91c176d1905317cea92c48743a524c0acd11038751d44
-
SSDEEP
6144:0z4/KDikuQ4KmMURPlqeeR3e/dOd6/NP8dnfIW:ChDll4WmlqNR3m4oNAn9
Malware Config
Extracted
Family
stealc
C2
http://bryanzachary.top
Attributes
-
url_path
/e9c345fc99a4e67e.php
rc4.plain
Signatures
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ea53efe7909227d8d1c3b96df3f2194947459d09d6168e629dd1d089b3a9c42_JC.exe"C:\Users\Admin\AppData\Local\Temp\7ea53efe7909227d8d1c3b96df3f2194947459d09d6168e629dd1d089b3a9c42_JC.exe"1⤵PID:1816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 3402⤵
- Program crash
PID:4856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1816 -ip 18161⤵PID:2392