Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 12:42
Static task
static1
Behavioral task
behavioral1
Sample
ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe
Resource
win7-20240704-en
General
-
Target
ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe
-
Size
448KB
-
MD5
76ba5272a17fdab7521ea21a57d23591
-
SHA1
6b831413932a394bd9fb25e2bbdc06533821378c
-
SHA256
ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261
-
SHA512
61dbf7fc1e2e5030a9c868edef37d9bd2a9e0ae96de87087929dce451e49df283089906c1fee619a7a53762f6d85f2802364a0ce0aa90d8cfc2153d79596075e
-
SSDEEP
6144:d9eE+BSAOxVxkRqEavXcboOGQoEZu77RaXZDs0DZ186LxSp6TyD61:CEPxxVxkRqdvOiQTA2Ds0N1XLxSOyu
Malware Config
Signatures
-
Detect WinDealer information stealer 7 IoCs
resource yara_rule behavioral2/memory/4352-0-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer behavioral2/memory/4352-1-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer behavioral2/memory/4352-8-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer behavioral2/memory/4352-7-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer behavioral2/memory/4352-6-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer behavioral2/memory/4352-9-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer behavioral2/memory/4352-19-0x0000000010000000-0x000000001003B000-memory.dmp family_windealer -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4352 ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe 4352 ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe"C:\Users\Admin\AppData\Local\Temp\ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121B
MD5e20dceef2a5fef6f1957b91a7c7cd82b
SHA1909b34885548e061f45a01aa96e7ca3485d09e63
SHA256e4c6c2c0e277fea432858ab8bb52c12b9b26939b8c693d5098bd09b197e0e024
SHA512098981bca1e1335383957c4913a896ade8d0f5b242334dbbc220e7ec7160f7716703dd6e3f3db7348fcc930b3ba7f25144d14b2ea758b6065ec3427a1d3e0219