Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01/07/2024, 08:04
General
-
Target
QQ牧场宝贝.exe
-
Size
283KB
-
MD5
4b18c843d1f5aa5c0a0511d8137fb0ca
-
SHA1
3b7db3134a3a15a3683a1c198c0c972c58e507b5
-
SHA256
842536f9891fd3842e8a6b74c667391a1e11b4a552c34414bc48f61fdbdd6c1b
-
SHA512
721f613673650df4c0762bf03bfd9af4b34b2f437940baa98b9cf5623eacea24b6ba820917d4dc605a539f04fd196a4794647a2cb7c82fd0c294fb600290dc2c
-
SSDEEP
6144:6EBLkxedjZJv+91z0/RCLIEX8494VLAJaBf04vCt7ssYInY:6cLkxe1n+Tz0/+SZXBf0ECt7ssYInY
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\QQ牧场宝贝.exe"C:\Users\Admin\AppData\Local\Temp\QQ牧场宝贝.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
4KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
1.1MB
-
Filesize
324KB
-
Filesize
4KB