Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 03:34
Static task
static1
Behavioral task
behavioral1
Sample
dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe
Resource
win7-20231023-en
General
-
Target
dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe
-
Size
8.6MB
-
MD5
f5c18dc1c7bb825ab9355fcf0772f398
-
SHA1
ef51285b0a4129c770842f1d4c041bae0ce53e82
-
SHA256
dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0
-
SHA512
bd71690cfbc3019fec7c1e3eec17a82a9fec280f0e28cb348f329bd0a5e9ca5f7f1de4004b84645baa0f27ec8936a2d714548bad6160faf9c1d39d92a56eec99
-
SSDEEP
196608:0vQO/26iZrVG5Jf808zwUIvP4Btk3CDHKhiBm4omLvorU:QQO/DEkf8xzw734BtnSCmlmDT
Malware Config
Signatures
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5080 set thread context of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe 1448 jsc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98 PID 5080 wrote to memory of 1448 5080 dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe"C:\Users\Admin\AppData\Local\Temp\dcbf2674b9529c0e3d22d9228b3519dfba6dc3062ea25112c134d090755927b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1448
-