Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 00:12
General
-
Target
1bfc139c595089757dc686da8c52ba56.exe
-
Size
55KB
-
MD5
1bfc139c595089757dc686da8c52ba56
-
SHA1
2439b8b5d6e61c41535a67a8f7e1e1bcee0e07d3
-
SHA256
29c910f59fb7647428369a13f53b61f8f3d6ab1c4f1efb834515a2a5195902da
-
SHA512
3165284c4ee43573c488f15814dd1da1a02c25b3369b8b598f8cd55c7f16f58dc32d7128654f62f3eb304e75812b72437a6389982f117cabea3a6935f0be4b9e
-
SSDEEP
1536:NQ56/eLLlTV/mGLfK+P/Rrh0anLF4vqUtrq+CbVj/kI7voN3NVNFcRbsENDYEQ24:NsDFK4VJ5q0G
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bfc139c595089757dc686da8c52ba56.exe"C:\Users\Admin\AppData\Local\Temp\1bfc139c595089757dc686da8c52ba56.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
324KB
-
Filesize
324KB