Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 16:16
General
-
Target
c1116ba2e276aa749850e23f17894f7abc525ed2f353be86b8989a5260593c28.exe
-
Size
4.9MB
-
MD5
ef965d1b963ab3e900ad7a64061fb51f
-
SHA1
806f80452279a880f5fe58c6a55bbf71e0802242
-
SHA256
c1116ba2e276aa749850e23f17894f7abc525ed2f353be86b8989a5260593c28
-
SHA512
fa705a3a6dc5e56814f62006a13dc8271368f4c9671523b32c96cd316097b2365e5918c96ca8c491db8c234220d494530fa3c1fe73e93d093d412a989dedc361
-
SSDEEP
98304:9EPxyXSgB0VJaEgEzNTSiLKwESgjMxSWzAP:8xJgB0hgEBTSiLKXSRjAP
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1116ba2e276aa749850e23f17894f7abc525ed2f353be86b8989a5260593c28.exe"C:\Users\Admin\AppData\Local\Temp\c1116ba2e276aa749850e23f17894f7abc525ed2f353be86b8989a5260593c28.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
1.6MB
-
Filesize
100KB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
1.6MB