Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03/06/2024, 06:45
General
-
Target
9f295b556f1731c0355b778e9a6c61b7ef6c4773451886592a9839aadc63f77b.exe
-
Size
9.2MB
-
MD5
220d436be62924e45fc4e7a08cb590bf
-
SHA1
f55c9e0c26d096104bac7ff081e9673223500ac8
-
SHA256
9f295b556f1731c0355b778e9a6c61b7ef6c4773451886592a9839aadc63f77b
-
SHA512
8de4b59d3b7628f75ca6e0f2760e200425d5c14f926100c93caaf642865e39e93ef12eec90d0691ab4c66daabe7046c2e77d1c3e48c8ebc527759c6b74898004
-
SSDEEP
196608:10/mSzMt7DznB220+69n/yzELjK+7i7/qv+Tfp4K:iOTt7DznB7l69/O+7i7C2TfpN
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f295b556f1731c0355b778e9a6c61b7ef6c4773451886592a9839aadc63f77b.exe"C:\Users\Admin\AppData\Local\Temp\9f295b556f1731c0355b778e9a6c61b7ef6c4773451886592a9839aadc63f77b.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ÏÉÔµ³ÁĬ3.0¡¾53XF.COM¡¿\404719f295b556f1731c0355b778e9a6c61b7ef6c4773451886592a9839aadc63f77b.exeC:\ÏÉÔµ³ÁĬ3.0¡¾53XF.COM¡¿\404719f295b556f1731c0355b778e9a6c61b7ef6c4773451886592a9839aadc63f77b.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27B
MD5a046fa99d1888b01f88675556d81e497
SHA1af69545274f263b6146264aec9acf3e4d17fbac7
SHA256f7e5b933be46d1985352de80088b4266306fbad5b4fecfc1dbaa334728599a07
SHA51262a339e05d70a5bdd5183f34c5aea5ef469c9db5b35efd56930ff44e9b0db632e0678c659ae9722489c3be591a521c6143458b6af946eee2c34e16bcc0d4e219
-
Filesize
9.2MB
MD5220d436be62924e45fc4e7a08cb590bf
SHA1f55c9e0c26d096104bac7ff081e9673223500ac8
SHA2569f295b556f1731c0355b778e9a6c61b7ef6c4773451886592a9839aadc63f77b
SHA5128de4b59d3b7628f75ca6e0f2760e200425d5c14f926100c93caaf642865e39e93ef12eec90d0691ab4c66daabe7046c2e77d1c3e48c8ebc527759c6b74898004
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB