Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 12:42

General

  • Target

    ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe

  • Size

    448KB

  • MD5

    76ba5272a17fdab7521ea21a57d23591

  • SHA1

    6b831413932a394bd9fb25e2bbdc06533821378c

  • SHA256

    ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261

  • SHA512

    61dbf7fc1e2e5030a9c868edef37d9bd2a9e0ae96de87087929dce451e49df283089906c1fee619a7a53762f6d85f2802364a0ce0aa90d8cfc2153d79596075e

  • SSDEEP

    6144:d9eE+BSAOxVxkRqEavXcboOGQoEZu77RaXZDs0DZ186LxSp6TyD61:CEPxxVxkRqdvOiQTA2Ds0N1XLxSOyu

Malware Config

Signatures

  • Detect WinDealer information stealer 7 IoCs
  • WinDealer

    WinDealer is an info stealer used by LuoYu group.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe
    "C:\Users\Admin\AppData\Local\Temp\ecd001aeb6bcbafb3e2fda74d76eea3c0ddad4e6e7ff1f43cd7709d4b4580261.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious use of SetWindowsHookEx
    PID:4352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8e98-fb8010fb\F_tmp

    Filesize

    121B

    MD5

    e20dceef2a5fef6f1957b91a7c7cd82b

    SHA1

    909b34885548e061f45a01aa96e7ca3485d09e63

    SHA256

    e4c6c2c0e277fea432858ab8bb52c12b9b26939b8c693d5098bd09b197e0e024

    SHA512

    098981bca1e1335383957c4913a896ade8d0f5b242334dbbc220e7ec7160f7716703dd6e3f3db7348fcc930b3ba7f25144d14b2ea758b6065ec3427a1d3e0219

  • memory/4352-0-0x0000000010000000-0x000000001003B000-memory.dmp

    Filesize

    236KB

  • memory/4352-1-0x0000000010000000-0x000000001003B000-memory.dmp

    Filesize

    236KB

  • memory/4352-8-0x0000000010000000-0x000000001003B000-memory.dmp

    Filesize

    236KB

  • memory/4352-7-0x0000000010000000-0x000000001003B000-memory.dmp

    Filesize

    236KB

  • memory/4352-6-0x0000000010000000-0x000000001003B000-memory.dmp

    Filesize

    236KB

  • memory/4352-9-0x0000000010000000-0x000000001003B000-memory.dmp

    Filesize

    236KB

  • memory/4352-19-0x0000000010000000-0x000000001003B000-memory.dmp

    Filesize

    236KB