Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

5ae776da38...5c.exe

windows7-x64

7

5ae776da38...5c.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/01/2024, 09:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5ae776da383c2619b2c0e662d789555c.exe

  • Size

    1.6MB

  • MD5

    5ae776da383c2619b2c0e662d789555c

  • SHA1

    5a4c2528100b2727b26c0b30297d380a1730d8c0

  • SHA256

    6983ef290e8760febb4dd373f991fec87b4e7957b09a665e06afab4fc1da58e2

  • SHA512

    1d820d8a46cf68a3bdbc0b8c940cdc23d6cc477afad9d18f63bdd032fe3865d48c40bebb20d82a1b12a0d818c1f63005f481253a172fef336dfa2d8e1fc0146e

  • SSDEEP

    49152:r/fwUdeRW1s5ycjkcSZEDghtAkf4tJh8TNkrB:rwUdf1GXj6BGt3Z

Score
7/10
spywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ae776da383c2619b2c0e662d789555c.exe
    "C:\Users\Admin\AppData\Local\Temp\5ae776da383c2619b2c0e662d789555c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Users\Admin\AppData\Local\Temp\5ae776da383c2619b2c0e662d789555c.exe
      "C:\Users\Admin\AppData\Local\Temp\5ae776da383c2619b2c0e662d789555c.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_924341bb0"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\pkg_924341bb0\autorun.txt
    Filesize

    91B

    MD5

    84e5bf4462d5a0b56a05451efec9ecb2

    SHA1

    d8aeab9106e8b4dc33fa9792533d03397a103b86

    SHA256

    732ca87ee5ad3329bd5faac6d98f9bffc677d7d4312187ffbde6935c9dc4e96e

    SHA512

    e42fc8eb4d58592cd23e5f84e8faf2942854ef79f2ff04d589a16346956e2e1c002e5d256c9e83732f637ae8c099482bb264dba66598dbe9d711dd9cde47229f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\pkg_924341bb0\wrapper.xml
    Filesize

    798B

    MD5

    1d45a29e3511b982a1f91b33c70e964f

    SHA1

    176a47b489be3f27dc354a2b9dd0b580bb2f3904

    SHA256

    0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

    SHA512

    c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

    Download Submit