Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
06/06/2024, 18:46
General
-
Target
2024-06-06_a151a32a0232239c8ea251c707aad212_bkransomware.exe
-
Size
13.3MB
-
MD5
a151a32a0232239c8ea251c707aad212
-
SHA1
a7cc96caa50f9cea4f3de9d31bd0fddb5638e9e6
-
SHA256
c533c7aa25582fd7496e0fb8c6f84f82435aff99e8e0c7097f3392405059d677
-
SHA512
ccb21be8743e263d0ac7d5763b62c8699fd91cfcdc5a2cde4814556932be444218a90be2f8df1cdbcb4bebe97b9b3cc21b2f35e1d7b3cf74cca2b52a175829bf
-
SSDEEP
98304:DJtjRMNT7Fn4xFzxKNzeIoZIaSv83J9r0fPEEy:NSTRnmFzxK9on/3J9oHa
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_a151a32a0232239c8ea251c707aad212_bkransomware.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_a151a32a0232239c8ea251c707aad212_bkransomware.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken