Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
17/04/2024, 10:04
General
-
Target
b9eed45780779e62c7a1925766ebfba99724aef89f14e7e36bb3634f1513545c.exe
-
Size
3.4MB
-
MD5
122bc8a870cb17fdb8f326d03770d80e
-
SHA1
f863dc5cc07b885fb5d4a39bbcdf35e8890af765
-
SHA256
b9eed45780779e62c7a1925766ebfba99724aef89f14e7e36bb3634f1513545c
-
SHA512
239955042da349881c31bf7d357750501954f1c61e27542f55cde61b866fe83363a784414908bff37ec4cded33470d78456bb2af7f958e860dd2a0c983087bb1
-
SSDEEP
98304:jWiD4pvFeiye1JCCXeyY2RBkzjxtFj0JhYA:jNcpvF3ye1JJM2OxjjaY
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 39 IoCs
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
VMProtect packed file 5 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9eed45780779e62c7a1925766ebfba99724aef89f14e7e36bb3634f1513545c.exe"C:\Users\Admin\AppData\Local\Temp\b9eed45780779e62c7a1925766ebfba99724aef89f14e7e36bb3634f1513545c.exe"1⤵
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PY435QFE74311975IO6M184Q570JNE.exe433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C623965656434353738303737396536326337613139323537363665626662613939373234616566383966313465376533366262333633346631353133353435632E6578652⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116B
MD505e3102d1b565e656adcc21bf997e97f
SHA132eaf0068e8180c233ba0a3de7678d9220774a9a
SHA256277439830570266f45e4e0a4a240bd947811e2f9c5004f35fd137f4326e116a5
SHA5127ccc9f39105eac68ceb6cd7483eede4a058b80601fde1763bfd09a31fd3f93d603dba4fa00287ae2fab4e25cf6df31e93bd6031ff11b1fd1dc069be61e72e027
-
Filesize
3.4MB
MD5122bc8a870cb17fdb8f326d03770d80e
SHA1f863dc5cc07b885fb5d4a39bbcdf35e8890af765
SHA256b9eed45780779e62c7a1925766ebfba99724aef89f14e7e36bb3634f1513545c
SHA512239955042da349881c31bf7d357750501954f1c61e27542f55cde61b866fe83363a784414908bff37ec4cded33470d78456bb2af7f958e860dd2a0c983087bb1
-
Filesize
94B
MD5d3abe1195c1187598593d52af42a18fe
SHA1a5757a8b77419a499333d9d4422da019f7d2f6be
SHA256a4743b60822308276041d448210b3b26067a79773109f4aa9fcc6f2a34f87b27
SHA512df7a0877e9b7bb2ffbc25f73cc4773e973839a783d8dd29a1d54f73773d52b19ed39ea2cd7fffea25b5ea42f0d2b9f6488c6f7ca0c183d4eefff8d7bb16b5241
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
10.6MB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
10.6MB
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
10.6MB
-
Filesize
10.6MB
-
Filesize
328KB