1dff748cbad8d2b8ec94f26a90f36ff1ace5cc273c95e2aa50aa704361672f84

Analysis

max time kernel
149s
max time network
130s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tr2gold.exe
Size

689KB
MD5

ee00d88ea1977a089f13b49efe6af6bf
SHA1

ca556def41de074538eabe6735842e3f2f58df78
SHA256

6acc27850054b599f87eff9cd016993dc65c288967f9bdb4e8a543e56df87b3a
SHA512

c1129217cb8e0d0e77eff9f3eb805b753f51f63492c78187dc87ad2013a4c2135efa756613cb14b9a7fc3a2f33f92bcb696ce9a3ca2168e7bc0ac7b861aede99
SSDEEP

12288:NYCBQ+xvUWbfFS92rUemPmAcGn21ByoIfoaJRhHsO1uEvc3px8s2RVz/Q7O:NYCBQ+x8N92rUTP3crsoCoaJrfIrP8sA

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

tr2gold.exe

description ioc process

File opened (read-only) \??\D: tr2gold.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

tr2gold.exe

pid process

568 tr2gold.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

tr2gold.exe

pid process

568 tr2gold.exe

description	ioc	process
File opened (read-only)	\??\D:	tr2gold.exe

pid	process
568	tr2gold.exe

pid	process
568	tr2gold.exe

C:\Users\Admin\AppData\Local\Temp\tr2gold.exe
"C:\Users\Admin\AppData\Local\Temp\tr2gold.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads