Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/02/2024, 05:09

General

  • Target

    a6d05b0664378a130d90943b169986c3.exe

  • Size

    715KB

  • MD5

    a6d05b0664378a130d90943b169986c3

  • SHA1

    34f5e5102ae59d14bcd3c18e13607edc2d0d42f7

  • SHA256

    48513a320dace9218b3612cb8496518620a07c9dc62f0e6d19f0e2639c6bc9f9

  • SHA512

    858667f11bcd7dcc4ded28657b68fc602b4cfee0d4c0490b6c3a80d503339b8c478f2a90db4a0a6c909f0d8ead5c6a1cb36f1d9a6a867233a54b773c00ba0f4b

  • SSDEEP

    6144:nA01Nd5uvxQWQSYYaE5CinBdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC2gWf7xLUnw+V:ndo5QWJnnBIShtdGxTC2Q5JL

Malware Config

Signatures

  • Detect Fabookie payload 2 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Modifies system certificate store 2 TTPs 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6d05b0664378a130d90943b169986c3.exe
    "C:\Users\Admin\AppData\Local\Temp\a6d05b0664378a130d90943b169986c3.exe"
    1⤵
    • Modifies system certificate store
    PID:1732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    4ddd2e13903aaddb9fed37b153558f13

    SHA1

    852349c437febdc7a68b7f1146a69ce0f3dc05c9

    SHA256

    ec6e7ce33ffd2407f71482dea24057c53ef8e20c4634e55f2e44f4119a54e956

    SHA512

    4c9b98ac1203882764d1d4bd7b79a3e15ce47faa6955f0c1cde188903abcb68df8a6523fe0c470bd7afe5443fdd02c8487a24a7b879c8fdb5c0bf4bb97c2ab9a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    9bbc89a83c95f41c36063baaebf3ff0e

    SHA1

    f152cbd6bd5a9853cbf980835d0bb7e910544e93

    SHA256

    7811ce8edaa2380f496c90ef778a2e2265065594fcd0774e083e95045489cc8f

    SHA512

    5fd7faaebcf8cca81c5eab478b7fe1718dbf575e0df18544fe8d23c48cb4e85cfebe479980dc63c39d19e993b8672867a5e113d71b998977b8e7a4f52105ca55

  • C:\Users\Admin\AppData\Local\Temp\Tar360.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/1732-0-0x00000000FF5D0000-0x00000000FF687000-memory.dmp

    Filesize

    732KB

  • memory/1732-108-0x00000000031C0000-0x00000000032CA000-memory.dmp

    Filesize

    1.0MB

  • memory/1732-109-0x0000000003520000-0x000000000364C000-memory.dmp

    Filesize

    1.2MB

  • memory/1732-112-0x0000000003520000-0x000000000364C000-memory.dmp

    Filesize

    1.2MB