Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
23/08/2024, 09:19
General
-
Target
SetLoader.small.exe
-
Size
6.2MB
-
MD5
0ea7c6316dd45ced14dbd5b06dfb2098
-
SHA1
6a53d81c044117204b5d256aeb121fa77ee23e78
-
SHA256
719b18a62ffd20ee2ac96d12cdb6a961469e00bed11255e1ce616f8747239bde
-
SHA512
1e934d7da30a5357f9715395b0c320fe59a32b3cf3ea298d410bb2d359fe397e34e45e792a0d189412bbc90970384d6dcfa46a6facbe570d42125a9c4113dcb2
-
SSDEEP
49152:gLnlZDQmTSiQb4N+rgzs5/cS3S7EI05pb2OiYbil7wOdmftCQor+gEu5+HDjlI3W:gbHfYb7EmfQ+gNICEvZ5
Malware Config
Signatures
-
DeerStealer 15 IoCs
Detects DeerStealer malware - JaffaCakes118.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SetLoader.small.exe"C:\Users\Admin\AppData\Local\Temp\SetLoader.small.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
6.2MB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
1.9MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
1.9MB