Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    18s
  • max time network
    449s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2024, 14:39

General

  • Target

    97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe

  • Size

    207KB

  • MD5

    729871063d04ce837b6b65a57f4a2153

  • SHA1

    25f77150f1d34d19afcb8e7b543d52630dee2862

  • SHA256

    97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a

  • SHA512

    dc1869dd47e2d1cd55a71aa589f691066b2638954c3de34a86b14dac6f66e9c004dec02355dd060b3f4eae631166e9e93c2fd786a354168a10776b3508eab575

  • SSDEEP

    3072:7ZyQGq+qT2atob56RHAKsSCLLBvAd2xLD0oVuAAg0FujoHtUjVVFOq0rO:7vRLDWkRHAKsSiPAOotUbF8O

Score
7/10

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe
    "C:\Users\Admin\AppData\Local\Temp\97b6e51df2a1187481fa28ada65be40fb6d727e0fa3b40cc6796780d680b300a.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3856
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:3412
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
        PID:860

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/860-2619-0x000001B436670000-0x000001B436680000-memory.dmp

        Filesize

        64KB

      • memory/860-2636-0x000001B43EC90000-0x000001B43EC91000-memory.dmp

        Filesize

        4KB

      • memory/860-2642-0x000001B43EC90000-0x000001B43EC91000-memory.dmp

        Filesize

        4KB

      • memory/860-2643-0x000001B43EC90000-0x000001B43EC91000-memory.dmp

        Filesize

        4KB

      • memory/860-2645-0x000001B43EC90000-0x000001B43EC91000-memory.dmp

        Filesize

        4KB

      • memory/860-2644-0x000001B43EC90000-0x000001B43EC91000-memory.dmp

        Filesize

        4KB

      • memory/860-2641-0x000001B43EC90000-0x000001B43EC91000-memory.dmp

        Filesize

        4KB

      • memory/860-2640-0x000001B43EC90000-0x000001B43EC91000-memory.dmp

        Filesize

        4KB

      • memory/860-2655-0x000001B43E7E0000-0x000001B43E7E1000-memory.dmp

        Filesize

        4KB

      • memory/860-2671-0x000001B43EB00000-0x000001B43EB01000-memory.dmp

        Filesize

        4KB

      • memory/860-2670-0x000001B43E9F0000-0x000001B43E9F1000-memory.dmp

        Filesize

        4KB

      • memory/860-2669-0x000001B43E9F0000-0x000001B43E9F1000-memory.dmp

        Filesize

        4KB

      • memory/860-2667-0x000001B43E9E0000-0x000001B43E9E1000-memory.dmp

        Filesize

        4KB

      • memory/860-2652-0x000001B43E8A0000-0x000001B43E8A1000-memory.dmp

        Filesize

        4KB

      • memory/860-2649-0x000001B43E8B0000-0x000001B43E8B1000-memory.dmp

        Filesize

        4KB

      • memory/860-2647-0x000001B43E8A0000-0x000001B43E8A1000-memory.dmp

        Filesize

        4KB

      • memory/860-2646-0x000001B43E8B0000-0x000001B43E8B1000-memory.dmp

        Filesize

        4KB

      • memory/860-2639-0x000001B43EC90000-0x000001B43EC91000-memory.dmp

        Filesize

        4KB

      • memory/860-2638-0x000001B43EC90000-0x000001B43EC91000-memory.dmp

        Filesize

        4KB

      • memory/860-2637-0x000001B43EC90000-0x000001B43EC91000-memory.dmp

        Filesize

        4KB

      • memory/860-2635-0x000001B43EC60000-0x000001B43EC61000-memory.dmp

        Filesize

        4KB

      • memory/860-2603-0x000001B436570000-0x000001B436580000-memory.dmp

        Filesize

        64KB