Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17/04/2024, 10:04
General
-
Target
b9eed45780779e62c7a1925766ebfba99724aef89f14e7e36bb3634f1513545c.exe
-
Size
3.4MB
-
MD5
122bc8a870cb17fdb8f326d03770d80e
-
SHA1
f863dc5cc07b885fb5d4a39bbcdf35e8890af765
-
SHA256
b9eed45780779e62c7a1925766ebfba99724aef89f14e7e36bb3634f1513545c
-
SHA512
239955042da349881c31bf7d357750501954f1c61e27542f55cde61b866fe83363a784414908bff37ec4cded33470d78456bb2af7f958e860dd2a0c983087bb1
-
SSDEEP
98304:jWiD4pvFeiye1JCCXeyY2RBkzjxtFj0JhYA:jNcpvF3ye1JJM2OxjjaY
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 39 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
VMProtect packed file 6 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9eed45780779e62c7a1925766ebfba99724aef89f14e7e36bb3634f1513545c.exe"C:\Users\Admin\AppData\Local\Temp\b9eed45780779e62c7a1925766ebfba99724aef89f14e7e36bb3634f1513545c.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CXSDOQRCEV6U3198F364V83NRS.exe433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C623965656434353738303737396536326337613139323537363665626662613939373234616566383966313465376533366262333633346631353133353435632E6578652⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116B
MD57d767988d3addc625a7f362907b26730
SHA1a90a5681e27800350e779bc5bf04ec8768bfcf6d
SHA256f6f2e838a4a958211bac94fb42cb70f08566d03aecdb35d7de39008609844d6f
SHA5128141a9f2c750582dafc362a6bbc717055e3a231027a1a845f9c205c571351f36d41685053e61111e04b6d4dedfb8f585a22994a340d57ffc7c632798cc5772e8
-
Filesize
94B
MD5ca58fc9034f5d3eb6235d4fa33d055b8
SHA10d59ed7f8bc65ea42d7eec77fdec478bc7914d81
SHA256da89498af09c14fa25d309366585ea56ed7eac011980bd8cb78c435c4945c6d1
SHA5120e258786cab4704713db45f76b684ad8be929b659bb983966710ff32c8e43a7794651204f347cf09803d250e8d4587ec4f1dcf0a32f90643fea68cfcccfc87f3
-
Filesize
3.4MB
MD5122bc8a870cb17fdb8f326d03770d80e
SHA1f863dc5cc07b885fb5d4a39bbcdf35e8890af765
SHA256b9eed45780779e62c7a1925766ebfba99724aef89f14e7e36bb3634f1513545c
SHA512239955042da349881c31bf7d357750501954f1c61e27542f55cde61b866fe83363a784414908bff37ec4cded33470d78456bb2af7f958e860dd2a0c983087bb1
-
Filesize
10.6MB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
10.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.6MB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
328KB