Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2024, 16:25

General

  • Target

    552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe

  • Size

    2.3MB

  • MD5

    bc055ee1a3e93a1f1cadb666d073aa39

  • SHA1

    3a0d99190c69380ce01a088d7b8850debe4cf0f8

  • SHA256

    552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752

  • SHA512

    e77c8e75f9b1bce8136ebdb1807915f81c37d80f03e29b55cde6ee3c1755484b312254f86264ccc7dac54e65d68e4a7a4987b615af1b0f9fd2c986d6c3a36988

  • SSDEEP

    24576:3qzIIUgC8d36kLBXlnB8j7v5Ta+hLLQ20JmXSeWwa1oWJQjk0svTS/PPsbb1hwRn:3sCOfN6X5tLLQTg20ITS/PPs/1kS4eW

Malware Config

Signatures

  • Blackmoon family
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

  • Detect Blackmoon payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe
    "C:\Users\Admin\AppData\Local\Temp\552f2ef9e25bf909ae321e78cb67edd809a529f5a81021f68e47e8d4923fa752.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2384
    • \??\c:\vvjpj.exe
      c:\vvjpj.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 36
        3⤵
        • Program crash
        PID:2392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\vvjpj.exe

    Filesize

    2.3MB

    MD5

    d7a15c41c29e76af1f998c0f53f517fc

    SHA1

    c1cc6ca8a5c5eaa63bc9191f2457e0b13e46c6b4

    SHA256

    98e27dd35ad91a3d009cf2f0982347664ea12470e08e4577102e7f65c9db79da

    SHA512

    987c770f403b0d89de0c8abe750f33d38685614fe40fe9e2cda485dd3341b543347e645e420d04e18ada4c561bd4adcd1ecf22230f9fce0cbc6b7b823c5bc325

  • memory/2384-0-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2384-6-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2528-8-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB