Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
268s -
max time network
309s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31/12/2023, 06:38
General
-
Target
2bed4bbed303c91e2169b2f32db46acb.exe
-
Size
204KB
-
MD5
2bed4bbed303c91e2169b2f32db46acb
-
SHA1
d55d2a47006dd5cf0077feec4a0bcc9c54ffad8c
-
SHA256
e054ceee8c38f4400f22cbe518fb4bf621cc0f945ae3f6fe333050c41205d434
-
SHA512
6d24fe96363606d11bd8d7cae8ae5aeeb932de5d804e546c51cd9fb864d0e08c6d97313fb54da9f53f2d58212b74f243e809826c05e94c6d93886bc39326162c
-
SSDEEP
6144:poOtHeu2kQ3Jc9OgmMrvH2w7KYBgJOljOl0fK6:preu2kQO9cMLHzRBgJOlSwK6
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bed4bbed303c91e2169b2f32db46acb.exe"C:\Users\Admin\AppData\Local\Temp\2bed4bbed303c91e2169b2f32db46acb.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\YouMeetWeWo\YouMeetWeWo.exe"C:\YouMeetWeWo\YouMeetWeWo.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cYGF4C.exe"C:\Users\Admin\AppData\Local\Temp\cYGF4C.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be
-
Filesize
182KB
MD539508b4b805c7272c3337cb3313484d8
SHA1cd7f6a53156db8cf95b9e8bbaa58f2843e85e3bb
SHA256f18c166c40b65372bfa2a78cd1b8cf4a82d0e19bac7ac2d5f5506b0268fe91e9
SHA512e8be2f4bed3fbfff9cf999a7c6bfb38c1aa6d205e75b4ec9afecd8ffaa74d2acbc893b9ccfbb05344692867ef4324613124da91162cb11f5c3103230873a7152
-
Filesize
4KB
MD5275cc028d033bc8223d9355aec162693
SHA1e1e06588afd0c9d90b2eef505ccf03e9374500ea
SHA256ab36d9ebeba8e628efe64de441286f2be13edc6a0a9447ff0d05d483d2e06985
SHA51201c929c9e49409b2c7c2b68ab4ee0e2953dfafd970b24031bd69a2c4194f6d7e85ddb63969f92145847776e2b55a932c4f81c5efbe8d535beba6d4f803cedd7c
-
Filesize
204KB
MD52bed4bbed303c91e2169b2f32db46acb
SHA1d55d2a47006dd5cf0077feec4a0bcc9c54ffad8c
SHA256e054ceee8c38f4400f22cbe518fb4bf621cc0f945ae3f6fe333050c41205d434
SHA5126d24fe96363606d11bd8d7cae8ae5aeeb932de5d804e546c51cd9fb864d0e08c6d97313fb54da9f53f2d58212b74f243e809826c05e94c6d93886bc39326162c
-
Filesize
128KB
MD5c340e6e9220c93bbbaafcc2f8b2468b7
SHA1c543ca758672717ebf8108e6ecea03b17c0469b9
SHA256a77e480f3c7b24f9a65a3486e4f330111cd6545515ea50afc2f7e2a68d59eba1
SHA51272fafec537f4bd9e5b63043cbe3a6aa6d5e7329ee73e391acbc039224bc889ce97588c049a1e45ecb404582aeeb947d15c7a3c745e9ab04a9986ce500dd08371
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.8MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
212KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
1.8MB
-
Filesize
8KB
-
Filesize
304KB
-
Filesize
1.8MB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
1.8MB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
1.8MB
-
Filesize
304KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
304KB
-
Filesize
212KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
1.8MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
8KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
20KB
-
Filesize
1.8MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
672KB