Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 05:43

General

  • Target

    2a788df7324700729a74b9ab8205aa18.exe

  • Size

    130KB

  • MD5

    2a788df7324700729a74b9ab8205aa18

  • SHA1

    477c4caa91fe5e707a4e5695504733572c30e5b1

  • SHA256

    593df76ca0273aa380aa50b84df8fb0a075648f3712dcb336b977f3cceaffb0a

  • SHA512

    5e4a6b25b2fa22a114828c1dfc51c0c575af4b851e0da23e2894a0b8c02eb0a5cba98ca05e95519253990a1296a198f280c7b58411cef5c294c5114ab757c399

  • SSDEEP

    3072:sFSoIkkXuqYfXG5AJg4/SAEZBiBx/1BFNI5wsdaechMcGIeq5i:sF9IkkkfwA3SZZBiBx9XNjsdaecmMD

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a788df7324700729a74b9ab8205aa18.exe
    "C:\Users\Admin\AppData\Local\Temp\2a788df7324700729a74b9ab8205aa18.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3980-0-0x00000000009F0000-0x0000000000A16000-memory.dmp

    Filesize

    152KB

  • memory/3980-1-0x00000000011B0000-0x00000000011E2000-memory.dmp

    Filesize

    200KB

  • memory/3980-2-0x00007FF9A94C0000-0x00007FF9A9F81000-memory.dmp

    Filesize

    10.8MB

  • memory/3980-3-0x000000001B710000-0x000000001B720000-memory.dmp

    Filesize

    64KB

  • memory/3980-6-0x000000001C230000-0x000000001C3F2000-memory.dmp

    Filesize

    1.8MB

  • memory/3980-7-0x000000001C930000-0x000000001CE58000-memory.dmp

    Filesize

    5.2MB

  • memory/3980-258-0x00007FF9A94C0000-0x00007FF9A9F81000-memory.dmp

    Filesize

    10.8MB

  • memory/3980-259-0x000000001B710000-0x000000001B720000-memory.dmp

    Filesize

    64KB

  • memory/3980-260-0x00007FF9A94C0000-0x00007FF9A9F81000-memory.dmp

    Filesize

    10.8MB