Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-08-18...re.exe

windows7-x64

7

2024-08-18...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 04:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-18_be585ec1173c64f7fad34271fd344b00_bkransomware.exe

  • Size

    144KB

  • MD5

    be585ec1173c64f7fad34271fd344b00

  • SHA1

    324b2e1271b52e6c3ba480a39b9ab4bf096a6c4b

  • SHA256

    e4455cc9aff329e4f0ebb6eab86dcf6f6b3a3c3204295997411dd2418ca992db

  • SHA512

    56a47d4902392c733af5f40b805ce2d5715026cab6b4cf7957e65f4ae3b5d43bc87c53c914d8ff85ba939956db351363f1d2a9f6a7616dff571f91cbbbfd9bf6

  • SSDEEP

    3072:ZhpAyazIlyazT74aSLKH0wHKZ5gHwGYhNUkFfQH13BQcYJYxf:hZMazP0p5pNvFfQPHYJYxf

Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-18_be585ec1173c64f7fad34271fd344b00_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-18_be585ec1173c64f7fad34271fd344b00_bkransomware.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Users\Admin\AppData\Local\Temp\EMDwEWtSTIU19QC.exe
      C:\Users\Admin\AppData\Local\Temp\EMDwEWtSTIU19QC.exe
      2⤵
      • Executes dropped EXE
      PID:3004
    • C:\Windows\CTS.exe
      "C:\Windows\CTS.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\EMDwEWtSTIU19QC.exe
    Filesize

    73KB

    MD5

    2ffc9a24492c0a1af4d562f0c7608aa5

    SHA1

    1fd5ff6136fba36e9ee22598ecd250af3180ee53

    SHA256

    69828c857d4824b9f850b1e0597d2c134c91114b7a0774c41dffe33b0eb23721

    SHA512

    03806d162931b1dcf036a51e753ff073a43664491a3cd2e649e55dd77d5e910f7bcf1e217eb0889ef606457b679428640e975ee227de941a200f652417bc6d5d

    Download Submit

  • C:\Windows\CTS.exe
    Filesize

    71KB

    MD5

    66df4ffab62e674af2e75b163563fc0b

    SHA1

    dec8a197312e41eeb3cfef01cb2a443f0205cd6e

    SHA256

    075a6eecd8da1795532318f9cf880efe42461f9464d63f74deb271d33110f163

    SHA512

    1588dd78e6e8972013c40cdb6acfb84c8df7b081197233ce621904b645356c805d0424bb93dd46c55834dc47d9ff39ee1323cf8e670841b3fff24ab98ba87f25

    Download Submit