Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22/05/2024, 02:18
General
-
Target
faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe
-
Size
287KB
-
MD5
a10420c0e62d533524339d8a8e5fa8c7
-
SHA1
b474bfc351e19a0174192e0fa3fe5b59a3ae3349
-
SHA256
faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2
-
SHA512
a0eef4471af693b5075ecc079f080e56b1e8cb04797186969d590d3391a5ccc97e925b59b04f45185124d292b1053c83ac351c12e9df64c8d317e312aa4121ae
-
SSDEEP
6144:mjGwSZAiQfBZAiF5FEca4jx1kEVfp7trTg1nV/3OnQJVrALo2hiZ/2b:mjGwShaLEvm1ZBYF+nKWM2AZ
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Sets file execution options in registry 2 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies Control Panel 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe"C:\Users\Admin\AppData\Local\Temp\faf9b2a7a9cde0866360f0964ffd39919262b623fedc9e0a1784ffab57bf1da2.exe"1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD58b3591965f623b219c0c528153746cab
SHA1020961494fa0e08779b7aacf4422269935354f7d
SHA25697ea3d99cf21123bc1aec72f9ded6a51ac659830392adfefd424eb799ab0219e
SHA5126e547197d160c9ec13cf2384add1bb6753276e3dab97d951adba9257d6bf999720635a7b9d94a5ca8b94bdda2f25f36c5938d126bc3e46a358e1fad072132351
-
Filesize
856KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
856KB