Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 09:08
Behavioral task
behavioral1
Sample
Generator__2_.exe
Resource
win7-20240319-en
General
-
Target
Generator__2_.exe
-
Size
17.0MB
-
MD5
5b200dd77e88dae76027a0c8c5eefbf5
-
SHA1
3d03e66b202007417683039801699c6bbea2f810
-
SHA256
700014da7ee4fdace03006daabfcf5f85d09c4a9a3654fdeb468370ceae85f97
-
SHA512
d8823e0e2abaa38ab86bb161be6c8e878fc3d6f2c05b80ea762678d28a51eb75d8fff8f6579c6b271973635e62ffd1843f7f69bf2115e28c9b16a28996ae7302
-
SSDEEP
393216:tML/au3GH6YkDInEroXHlh2pWsKkXgAW+TA39mmpDN1BlyNuW:tMLS0GHfjErUFQpWoMQA3H1Tyf
Malware Config
Signatures
-
Loads dropped DLL 46 IoCs
pid Process 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe 812 Generator__2_.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 20 discord.com 13 pastebin.com 14 pastebin.com 15 discord.com 16 discord.com 17 pastebin.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 812 Generator__2_.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1956 wrote to memory of 812 1956 Generator__2_.exe 89 PID 1956 wrote to memory of 812 1956 Generator__2_.exe 89 PID 812 wrote to memory of 1980 812 Generator__2_.exe 90 PID 812 wrote to memory of 1980 812 Generator__2_.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Generator__2_.exe"C:\Users\Admin\AppData\Local\Temp\Generator__2_.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\Generator__2_.exe"C:\Users\Admin\AppData\Local\Temp\Generator__2_.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:1980
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5e7c95d989f007786cda4b54894e23324
SHA1af714650fd9b4dd6045794f2cbb6c5621c45f6aa
SHA256212d10b7325cdb8eaf396b2aaa79dafa43956a0af6e691f3be87666f6fb1c231
SHA512d0efba931797c60de87a21f39e8d3d63ab03772ccd3771a4e0f6d872113e670540192e36643de0843e83a4a2a63f10060089f17652a6f88ac9f96d741d0b656c
-
Filesize
13KB
MD56ae43d2c62d952dbd9051578ca599fad
SHA1d6a279a67698973b30fe628b9cee9b33d5f12782
SHA25677c9237a83c93eefc7f9b77fe9ece986347cdd2133fab0bbd689130348792023
SHA512a8b9fb807e7cca02dfd2214a62024bd3cdbef111d36160fbf634b9a26ec089eb5252c602dd2ddb4c91111493719e4a338414b0e9409ba7936597db4d5e85b209
-
Filesize
14KB
MD5c5baa6c0144bf573c8432d08cf860afc
SHA128098a22da6612768b3abf7a68e6dbca96cff75d
SHA2565ddf2cec188a2780422f3fec7ce361a65233122f1ca1d3c15ee56aed5e0979d7
SHA512b2bdb7702bed5ca8ffb5cdae9d0296656897745c30f034ef163b465cb7bbeed468efb0754044baa203a64f8383c69a7216e8745657e285f0120d91c044e4dc17
-
Filesize
10KB
MD5a53f967c7f308382c614673786ced69f
SHA1088d0d77bd4be9f516dbc4e382c8332aceb50baf
SHA2562d8192595f0c71aeb0cde722d499c9b9e82634c013a59adad3b53f66c610cdb1
SHA5120466fd9512fad68725f547b9849682bbca6ae152f3732efc0c75cf7469c324086f0016f5340d9db57fd529d1b8f8fe6472702f350e30480d6c852f7b1164f5d6
-
Filesize
12KB
MD5f060f3436755e840cb8ae89ed7f129a7
SHA1900bd11e5849ed28683221623dc42a5c9cb18d1b
SHA256b45a709701dea57ee4fa75847225cc152b1fd989829fc6e6de1d60b72970c084
SHA5125ed72dafb936e0a710870f302c0e60348babfdabfc493ed5f51c9a8f25f08242746700d79fe444fc4f79766450eff093a498eb40c4e0e3108337dab9e81e0ba6
-
Filesize
94KB
MD5a87575e7cf8967e481241f13940ee4f7
SHA1879098b8a353a39e16c79e6479195d43ce98629e
SHA256ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e
SHA512e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0
-
Filesize
78KB
MD5e877e39cc3c42ed1f5461e2d5e62fc0f
SHA1156f62a163aca4c5c5f6e8f846a1edd9b073ed7e
SHA2564b1d29f19adaf856727fa4a1f50eee0a86c893038dfba2e52f26c11ab5b3672f
SHA512d6579d07ede093676cdca0fb15aa2de9fcd10ff4675919ab689d961de113f6543edbceecf29430da3f7121549f5450f4fe43d67b9eab117e2a7d403f88501d51
-
Filesize
179KB
MD5282b92ef9ed04c419564fbaee2c5cdbe
SHA1e19b54d6ab67050c80b36a016b539cbe935568d5
SHA2565763c1d29903567cde4d46355d3a7380d10143543986ca4eebfca4d22d991e3e
SHA5123ddebdc28d0add9063ee6d41f14331898f92452a13762b6c4c9aa5a83dde89510176425c11a48591fa05c949cb35218bf421f1974e33eb8133a1b95ea74e4941
-
Filesize
116KB
MD5c8f57695af24a4f71dafa887ce731ebc
SHA1cc393263bafce2a37500e071acb44f78e3729939
SHA256e3b69285f27a8ad97555bebea29628a93333de203ee2fae95b73b6b6d6c162b1
SHA51244a1fb805d9ef1a2d39b8c7d80f3545e527ab3b6bfc7abd2f4b610f17c3e6af2ae1fed3688a7cc93da06938ae94e5e865b75937352d12f6b3c45e2d24b6ab731
-
Filesize
57KB
MD54fb84e5d3f58453d7ccbf7bcc06266a0
SHA115fd2d345ec3a7f4d337450d4f55d1997fae0694
SHA256df47255c100d9cc033a14c7d60051abe89c24da9c60362fe33cdf24c19651f7c
SHA5121ca574e9e58ced8d4b2a87a119a2db9874cd1f6cedef5d7cbf49abf324fb0d9fb89d8aac7e7dfefbeb00f6834719ed55110bcb36056e0df08b36576ffd4db84c
-
Filesize
149KB
MD580da699f55ca8ed4df2d154f17a08583
SHA1fbd6c7f3c72a6ba4185394209e80373177c2f8d7
SHA2562e3fd65c4e02c99a61344ce59e09ec7fde74c671db5f82a891732e1140910f20
SHA51215ea7cd4075940096a4ab66778a0320964562aa4ae2f6e1acbe173cd5da8855977c66f019fd343cfe8dacc3e410edf933bce117a4e9b542182bad3023805fd44
-
Filesize
1.1MB
MD58b646e00d0842fba26c68a7d530d8bdf
SHA14c21ac45b7e18ceee7e775310092b0e4b142b6d8
SHA256e5f0ac4556706fc2f89b7d09fa2e4734ddcd038d91f0d3be3dec7c72800f6249
SHA51294c4c8f7979352739f2c9e3f87748c7119dba038708f3bf5d3d523f04d1f6993786bb9a1c05730ce950e39685b089bb39049afd5354bb562408253b2ad024ca7
-
Filesize
26KB
MD57e7d6da688789aa48094eda82be671b7
SHA17bf245f638e549d32957a91e17fcb66da5b00a31
SHA2569ad5bcf2a88e1ffff3b8ee29235dc92ce48b7fca4655e87cb6e4d71bd1150afb
SHA512d4c722e741474fe430dd6b6bd5c76367cc01ae4331720d17ed37074ad10493cc96eb717f64e1451e856c863fbb886bdc761d5a2767548874ba67eabf57ac89bd
-
Filesize
72KB
MD57f25ab4019e6c759fc77383f523ef9af
SHA15e6748ce7f6753195117fdc2820996b49fd8d3af
SHA256d0497b79345b2c255f6274baea6ac44b74f345e111ab25bf6c91af9b2a3f3b95
SHA512a179b22c61f661e4d9b17f56b6a7f66f2d8d8e1d2a9a8aca3c4d6a9cb7755ce6d223bfbca817c1098692a39b6fc20ffbdacefd9bfb47ff02ffa47badca437514
-
Filesize
91KB
MD5485aa66e439a3fe177dc41ca99c47764
SHA1804c3e453f033f32e7550f5665b4275e68b8addd
SHA25689d32e0206c06cdd196c1dc97a7540d8893eb31ec4703c996494ac68ca62dc7d
SHA512d40eec1e2a63f141752f4a8390db1f20720601cce6ce98f16f7f2bbbc41234d1b290dee2399e9b0e65774751bc6c4c39a3c200adda1e78b1362d293420c3506b
-
Filesize
152KB
MD5cf2f95ecf1a72f8670177c081eedeb04
SHA16652f432c86718fed9a83be93e66ea5755986709
SHA256ba6025ab22d8e6c5ad53c66dc919f219a542e87540502905609b33dc0a8dddd8
SHA5127e5df920f6acb671e78078e9c4fa3278ae838ea6bef49c0ae44de6a79923a3d7bccf0fb3f0e477ca5092e23450494dee265d8735b24d8026456e1328f6fe8b2e
-
Filesize
811KB
MD58a217b4a6c7acea571780019931f3813
SHA19c6e48cadce854d236577dc6508223ff745eefae
SHA25658402fcb6431d68728c3b3de79e6101aec64c640dc730082637fd1c10be64efd
SHA51239a6b910ef58ff3e8a58cfb9e186359010c63670869139560ddbd80114271816173befe5111808a78e4c556b8a0c8955d6f7178d6a7083e4a7747ccbf8290618
-
Filesize
3.3MB
MD563c4f445b6998e63a1414f5765c18217
SHA18c1ac1b4290b122e62f706f7434517077974f40e
SHA256664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
SHA512aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
678KB
MD5bd857f444ebbf147a8fcd1215efe79fc
SHA11550e0d241c27f41c63f197b1bd669591a20c15b
SHA256b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
SHA5122b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a
-
Filesize
11KB
MD5c6fbfce27f85e5ed72803ba30cc461c5
SHA1fee41ab62b1f6c12170b5cbcf0ba4b76e1969a13
SHA256c6a64ef96fbf183a32647781ca67aa316a96686f143c7c86dea580dc846744f3
SHA512d104c5f050af9d4c28aba5abf7460846e566b2bcdb330e08ddc317dbe794fce816e5ce3321fe1519f7ef99d5e4d9a5eb14c4e3b0ef2f60b99e53ce37f60be668
-
Filesize
73KB
MD56c9579b66f61b6c7862fb340c28325c2
SHA1e1ae6ca1714c0ae8cecb049e5ab8fbdaab02ac7c
SHA256ba25e2c928398a5e6c6bd35088f0e4ad7e1e0eaa29f7fed45ea079e844063670
SHA512c89fc859d0fd5f9ffeab1043b60507ecbfd78569bf55297fabd11df7c7d45e7c89a5f4d0a978cfe9f099d8ca3536970079f4dfce5bea1d330d2a251173bad6cd
-
Filesize
187KB
MD54135f7cc7e58900575605b7809ef11f9
SHA1500c2d16d0d399ab97db65ca5dc4f9a40925695d
SHA25666b14ebdd917f046315b666f841ea54a32760ecd624863071da8d3f1fd24459b
SHA512c677c1e97e682213245641155210919278b8917e6ed2df756dd181809dd16555b700a063514c327cd8da3183b8d3f492b4b143ed076702889c35a1f53e663686
-
Filesize
60KB
MD564a9384c6b329fb089e4d1657a06b175
SHA1ba0e6fcc3b1406356a40b9d8577b2e7ce69c4aea
SHA256ec655cc34819d6a9677c0541fd7e7b2b8a92804e8bf73aee692a9c44d1a24b5d
SHA5129593d38abfd46bb94409838dd9cbe603fbe154fa0043959512afc264dceec50d846eefa409bcf9936ee1a7c7313604a578b4051eb6fd6918f2beb0da6c8ee532
-
Filesize
4.3MB
MD5316ce972b0104d68847ab38aba3de06a
SHA1ca1e227fd7f1cfb1382102320dadef683213024b
SHA25634f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e
SHA512a11da6590a71d977c62b1c26c275763413f6a455e6d85fa052654d05d845dbbe8122bbd8e0a23887f9873d4291382ebbd5df19674ad2dda1cf0ff3206054939b
-
Filesize
543KB
MD5b7acfad9f0f36e7cf8bfb0dd58360ffe
SHA18fa816d403f126f3326cb6c73b83032bb0590107
SHA256461328c988d4c53f84579fc0880c4a9382e14b0c8b830403100a2fa3df0fd9a9
SHA5124fed8a9162a9a2ebc113ea44d461fb498f9f586730218d9c1cddcd7c8c803cad6dea0f563b8d7533321ecb25f6153ca7c5777c314e7cb76d159e39e74c72d1b8
-
Filesize
139KB
MD5f200ca466bf3b8b56a272460e0ee4abc
SHA1ca18e04f143424b06e0df8d00d995c2873aa268d
SHA256a6700ca2bee84c1a051ba4b22c0cde5a6a5d3e35d4764656cfdc64639c2f6b77
SHA51229bf2425b665af9d2f9fd7795bf2ab012aa96faed9a1a023c86afa0d2036cc6014b48116940fad93b7de1e8f4f93eb709cc9319439d7609b79fd8b92669b377d
-
Filesize
24KB
MD5589f030c0baa8c47f7f8082a92b834f5
SHA16c0f575c0556b41e35e7272f0f858dcf90c192a7
SHA256b9ef1709ed4cd0fd72e4c4ba9b7702cb79d1619c11554ea06277f3dac21bd010
SHA5126761c0e191795f504fc2d63fd866654869d8819c101de51df78ff071a8985541eec9a9659626dfcb31024d25fd47eff42caa2ae85cc0deb8a11113675fac8500
-
Filesize
1.4MB
MD529725c00f4e6a3035bb12ca64a20a2f3
SHA13f27663b93a75e5595cb4bb48509d31055d86ff6
SHA25620290d47f466c31d5f412eca9f412a9b1d45aa5c2be3d9719f9a12b970c635f4
SHA512a6f8d56b44a982ff7585ba52de05ba1bc026f2982a1d0bec80cf2add8a10bd64475c8fb8f8c5f4308d807be036bad0958931e67cffc489547181faa2d39a59ae
-
Filesize
1.1MB
MD5ababf276d726328ca9a289f612f6904c
SHA132e6fc81f1d0cd3b7d2459e0aa053c0711466f84
SHA25689c93a672b649cd1e296499333df5b3d9ba2fd28f9280233b56441c69c126631
SHA5126d18b28fb53ffe2eebd2c5487b61f5586d693d69dd1693d3b14fb47ca0cd830e2bd60f8118693c2ff2dcb3995bbfcc703b6e3067e6b80e82b6f4666ca2a9c2ca
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
131KB
MD5ec7c48ea92d9ff0c32c6d87ee8358bd0
SHA1a67a417fdb36c84871d0e61bfb1015cb30c9898a
SHA256a0f3cc0e98bea5a598e0d4367272e4c65bf446f21932dc2a051546b098d6ce62
SHA512c06e3c0260b918509947a89518d55f0cb03cb19fc28d9e7ed9e3f837d71df31154f0093929446a93a7c7da1293ffd0cc69547e2540f15e3055fe1d12d837f935
-
Filesize
124KB
MD5d1926c02329c6b787d9d02e02e1bca6b
SHA1df273a5e9268dbcb732b9e7ef9582b72a4a04aaa
SHA2564b5c954d537fac26ad97664c3eb1e43ad5f89ff93f40848e375c1598e35e36b6
SHA51247aa67aa92dc5845705b4b3e664712728b589d6e570dfdcad0242ecc212161614592a70485f0fce8ba4805f63289db40a05b8efb0834e1cea8cdf9b2a4a65de4