Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

751f2d5097...14.exe

windows7-x64

7

751f2d5097...14.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 17:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    751f2d5097fc2ba1bebf9170bda56a14.exe

  • Size

    1.5MB

  • MD5

    751f2d5097fc2ba1bebf9170bda56a14

  • SHA1

    ffa99d54d6443ca20e7306597acc7340b8a88eb0

  • SHA256

    c9cc5c0b7d439c7881227618879dc53ea07ddb4b649cef39fc0a1b1da6c4d476

  • SHA512

    f32d30f830775b5cf896d9fee826eea114d59ef42fe4bd6db2037a098904e1325869094785a791ce88a4f7536dbfce2d15a611a43b3f3e187afc0a431726b1b3

  • SSDEEP

    24576:D2RtsxfT5Ecc6hwjZhWlkPzYiPnoIs9WoyZpGeWJkRUndufH5NTQ9FjnOAJIHZ:WkfTNEfWlQzBPnoIs9WoynWaaAfXTYFo

Score
10/10
kinsingloaderspywarestealer

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

    loaderkinsing
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe
    "C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe
      "C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_112a26680"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\pkg_112a26680\autorun.txt
    Filesize

    75B

    MD5

    dedd637ddbf046e30073a331661f9c07

    SHA1

    ab5f8164ea28c3b43ef05d20a45fe05d56b55362

    SHA256

    ea421d768126b1dcd0892be805e7cd22c1ccc662cd744bc4bac801264be8e722

    SHA512

    c8d63d624c71ed717dfedf3940c5a3983f9b5626c16a2ff4357ad3c02f20040742d8ad33247cc0b60c1ce82ca4b57fd402ddb7e27fe04138f37f152725a1fd65

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\pkg_112a26680\wrapper.xml
    Filesize

    798B

    MD5

    1d45a29e3511b982a1f91b33c70e964f

    SHA1

    176a47b489be3f27dc354a2b9dd0b580bb2f3904

    SHA256

    0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

    SHA512

    c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

    Download Submit