Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
24/05/2024, 10:29
General
-
Target
0e45d73cde6670fd896f3053bc9f3cd4dd72564baabd48a3bd4c61446a393172.exe
-
Size
15.7MB
-
MD5
c37769349f9caa3530f3f1b9f08407a4
-
SHA1
318ff126b4202a66af1a7d1681f19c225147b0e0
-
SHA256
0e45d73cde6670fd896f3053bc9f3cd4dd72564baabd48a3bd4c61446a393172
-
SHA512
d563f3a28183230c66f85a9cbe0893a9d332aa5226d734cf4ce93e10fc9e1bc8983009a08bebdc8e103c76361d7f0fa1f6c662f4d19eec66fc60bede6b1b057e
-
SSDEEP
393216:gPDP5LEFmyEfXGNodC5w3LhAvx1+I3ryKUA3f/u8oEM0xPIcF:YxLEUy1R5w3La+I7sI+Yb
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 8 IoCs
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e45d73cde6670fd896f3053bc9f3cd4dd72564baabd48a3bd4c61446a393172.exe"C:\Users\Admin\AppData\Local\Temp\0e45d73cde6670fd896f3053bc9f3cd4dd72564baabd48a3bd4c61446a393172.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\5pksÓ²ºº¹éÀ´\217460e45d73cde6670fd896f3053bc9f3cd4dd72564baabd48a3bd4c61446a393172.exeC:\5pksÓ²ºº¹éÀ´\217460e45d73cde6670fd896f3053bc9f3cd4dd72564baabd48a3bd4c61446a393172.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.7MB
MD5c37769349f9caa3530f3f1b9f08407a4
SHA1318ff126b4202a66af1a7d1681f19c225147b0e0
SHA2560e45d73cde6670fd896f3053bc9f3cd4dd72564baabd48a3bd4c61446a393172
SHA512d563f3a28183230c66f85a9cbe0893a9d332aa5226d734cf4ce93e10fc9e1bc8983009a08bebdc8e103c76361d7f0fa1f6c662f4d19eec66fc60bede6b1b057e
-
Filesize
16B
MD5f8e97d17f4a2a53e85acd5a72d087750
SHA1ded43646ffffe97d19e96b76aeac2d7c4a4b6632
SHA256d854e841c3facdaf93f88e7749564cd91be33c4a817bf0844a6e0607bcbbd912
SHA5129c5fc6728fdf8f96e79c16458bacdcdba9ad85c6bb058f1de20b957ad7adb88ebd488fae4d01c47e8c6a8ec1645526cafaa528c7ad7b6f8cb0342a39bd3605aa
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
5.1MB