Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
126s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31/12/2023, 00:39
General
-
Target
665b1e8924e8117ddaa0d7628ac3ad70de8c4c4456ccf14bd9871c246f0de69e.exe
-
Size
21.7MB
-
MD5
2cf0141f66a75fbb26d52bf0f14ea33e
-
SHA1
cb102b2af2ca691671f360c420e63f41090c33f5
-
SHA256
665b1e8924e8117ddaa0d7628ac3ad70de8c4c4456ccf14bd9871c246f0de69e
-
SHA512
971a5e29f20c9e4b85fc9f777b691f51cf46ec39181728ea609a67d423cdd5a184271dd3d36d209f0c6f75850018cd05cf959109eefaf71ce6fba14952353db3
-
SSDEEP
393216:ooOSZ3Thb86/dTIaLOxkaq5Z4lmGrvRAVedwOdi+gNDc0anLOcs0edJsv6tWKFd7:oonSLncn
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\665b1e8924e8117ddaa0d7628ac3ad70de8c4c4456ccf14bd9871c246f0de69e.exe"C:\Users\Admin\AppData\Local\Temp\665b1e8924e8117ddaa0d7628ac3ad70de8c4c4456ccf14bd9871c246f0de69e.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx