Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
02/02/2024, 15:59
General
-
Target
SMS sender 2023/SMS sender 2023/Stub/Stub.exe
-
Size
165KB
-
MD5
42d8629b369faad755daeb690519f265
-
SHA1
6150c6865d440cd454d212312226e0eaeadc3d24
-
SHA256
014f68a3f73a8c94a12fa9842f12fc87ce2ad600dfe7fddea2ff7bc7ec79058f
-
SHA512
0b4139ad76944781fdece58f5318572b75bc3e367a7f01ce124495cc8c30daf8e512f0be77b7998aca21a0e03539f43f6e9fc7d4475b5573f54b19ad1e6d9a3d
-
SSDEEP
3072:Xj5R5s6Fmrw8bw4gSnaxkWdDzXqIPu/i9bOO2cq6+WpDheMGnWc:1mrw8E4gqanDbXPSi9bpMR
Score
10/10
Malware Config
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SMS sender 2023\SMS sender 2023\Stub\Stub.exe"C:\Users\Admin\AppData\Local\Temp\SMS sender 2023\SMS sender 2023\Stub\Stub.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 10042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4004 -ip 40041⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB