Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

e8c91023fd...bf.exe

windows7-x64

7

e8c91023fd...bf.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 04:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e8c91023fde3170eee83953872c1800e5251ad6af34e8ec651389e417ec720bf.exe

  • Size

    2.1MB

  • MD5

    0ece05cbb32cceaba6853d455b09bb6d

  • SHA1

    dff79169b9c701a18088b3171293f44b732e85df

  • SHA256

    e8c91023fde3170eee83953872c1800e5251ad6af34e8ec651389e417ec720bf

  • SHA512

    7ba9ea0e2e7d9fc084f83185c4e2f86d0ce145a40559ce2b8196eb0eb904903255b5fb2364346f8f82135fd6d9c75d4828cc776580c9314728ca1f6732adea0a

  • SSDEEP

    49152:VLM67z7t/7yZAsKVv/pun+AS2knlyAqB+XKY5jt:S67zx/7yZou+ASdlyRB+60jt

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8c91023fde3170eee83953872c1800e5251ad6af34e8ec651389e417ec720bf.exe
    "C:\Users\Admin\AppData\Local\Temp\e8c91023fde3170eee83953872c1800e5251ad6af34e8ec651389e417ec720bf.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Admin\AppData\Local\Temp\e8c91023fde3170eee83953872c1800e5251ad6af34e8ec651389e417ec720bf.exe
      "C:\Users\Admin\AppData\Local\Temp\e8c91023fde3170eee83953872c1800e5251ad6af34e8ec651389e417ec720bf.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Users\Admin\AppData\Local\Temp\e8c91023fde3170eee83953872c1800e5251ad6af34e8ec651389e417ec720bf.exe
        "C:\Users\Admin\AppData\Local\Temp\e8c91023fde3170eee83953872c1800e5251ad6af34e8ec651389e417ec720bf.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1440
    • C:\Users\Admin\AppData\Local\Temp\e8c91023fde3170eee83953872c1800e5251ad6af34e8ec651389e417ec720bf.exe
      "C:\Users\Admin\AppData\Local\Temp\e8c91023fde3170eee83953872c1800e5251ad6af34e8ec651389e417ec720bf.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:3504

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\french bukkake animal uncut beautyfull (Kathrin,Gina).mpg.exe
    Filesize

    540KB

    MD5

    b6b7492513f4dc1b4677783230d3fb7c

    SHA1

    af293b78dc22c201fa61da5ca4b0bc5f13a09fee

    SHA256

    70df959e516b8178f1d07348e174403d60fb7fcb112d7a24bfe3a50046e6930f

    SHA512

    48301ec53ac293082abdfd287d97dfedbc0fc6e54204516d3a9fc90610dbf6e553cba7710a99e0d000afb8dc7defe13fe1bea1fdc151e3bf0a9d0a206ae671c1

    Download Submit

  • C:\debug.txt
    Filesize

    146B

    MD5

    3f6d0556db701a296140a5151708111c

    SHA1

    00a2b80024b236f4e907fbb55dfc6ea4b7fa3302

    SHA256

    751c812dca3980a83ae93182fc43905d7035ddbfcff428c9521dad4dd0f31553

    SHA512

    c7a8e2be13dc779583267e741792074f85fc13fe1fe096f839d9fc3739477cafa3f334d3423450cdd199c9bf2209c31eb9da3d551040c1f0f863f2dfaffeb4a1

    Download Submit