Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02/02/2024, 16:05
Static task
static1
Behavioral task
behavioral1
Sample
89f292660c7c5740fd18f20a7beaf61e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
89f292660c7c5740fd18f20a7beaf61e.exe
Resource
win10v2004-20231222-en
General
-
Target
89f292660c7c5740fd18f20a7beaf61e.exe
-
Size
637KB
-
MD5
89f292660c7c5740fd18f20a7beaf61e
-
SHA1
934009a9bc2d76d0e9a976bd1aee84a517abc7f3
-
SHA256
27f20d38364f02a196758383b005350d063efb2f49e9f7b4f8a3cd7bd43900f9
-
SHA512
3cb87bea4c4fe4d3bbd633ddba303a14cc6d348e9382621094080adeedd2b9cab1e68b58a0c4add8fc37aee32d2f6ab18f03a1d7a3c52711a894b123132ddf22
-
SSDEEP
12288:2zKTBwOoP9oO6ZQTjwbkJPyXpJmuIwFPzk605Aky+oklRfg1JOpA0zvZ3:eoGPyRQXkkJaXrmu05Ak6MRoXyhB
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2968-1-0x0000000000400000-0x00000000005C4000-memory.dmp upx behavioral1/memory/2968-4-0x0000000000400000-0x00000000005C4000-memory.dmp upx behavioral1/memory/2968-5-0x0000000000400000-0x00000000005C4000-memory.dmp upx behavioral1/memory/2968-6-0x0000000000400000-0x00000000005C4000-memory.dmp upx behavioral1/memory/2968-7-0x0000000000400000-0x00000000005C4000-memory.dmp upx behavioral1/memory/2968-11-0x0000000000400000-0x00000000005C4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SmartIndex = "C:\\Users\\Admin\\AppData\\Local\\Temp\\89f292660c7c5740fd18f20a7beaf61e.exe" 89f292660c7c5740fd18f20a7beaf61e.exe