Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23/11/2024, 03:24 UTC
General
-
Target
c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe
-
Size
145KB
-
MD5
913458a5e9eb4026c62609375b534227
-
SHA1
9739ae38effef090b3b558531e01bf2252bd018f
-
SHA256
c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6
-
SHA512
5b653989cafdbd586216ccd11d243001b066b044df93478f574577f170b72a84b3831c89933c023ac458d8c2d4fb2fe4cdfcac0608806258150c3df101a79275
-
SSDEEP
1536:DzICS4AAwczUUf8y8gvMH+1zGSNAojMP95D1xDXcl74OOjAp31AyNpCSV6O9xv2T:cqJogYkcSNm9V7DG98YlXjCSV6O9R2T
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe"C:\Users\Admin\AppData\Local\Temp\c1e76af376454bab05e44634ca4e017e7607e41c9df6e067162d28064a1c7cd6.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\696D.tmp"C:\ProgramData\696D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\696D.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD50500a39f0d8cf6782b5e63a652b8a338
SHA146b32c170be5d2b89f873887c62f86cffbae6a3c
SHA2563ad34fa656a974764608f5c9e83ca6e555e1461f383f58f800c29f931725dd54
SHA51227740a7c6a87a0ba6ebf11d9ef578f5d468eed793cc22a58c330b36ed873be39dee02723f0829b4755649771063a5d846b19328cf8acde7a44421b1319adaa93
-
Filesize
452B
MD5c3ca0b5b87b140b357e8aa5927b8bdfe
SHA1e0d1c1c8edb7ce192218f0181a210d64ef2c005b
SHA256496392d3bf85b48fc8c199e59d3d77848c496bc600d4df51331f2302b2910ed2
SHA512b1f881d06206cc564a1b07bd1d7ab1967740c12533a67cf3bd7397e9520430a36111dae90bad5a575aa94b595cb84246bc8d5bea54e8159da3d69817d9766b97
-
Filesize
129B
MD5e7285403e50be7c96e4ea878d7a5c842
SHA1e0926e790dd0fb8a438e1a2ec8692e43b72a8ccc
SHA256e25dcdf37d3c69a1518e176f343c37534102f55dc97c523759b643d6e14595c0
SHA512b7f6f7a2849c03c00c24c04011b88ad8f424f858a2842bd9df4fe4f036015c8cc123c0cf5f03e7e9405b669eccd79c1b6e2151c42c245123cbaad6d84ae58ee2
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
Filesize
12KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
256KB