Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
26/02/2025, 03:50
Behavioral task
behavioral1
Sample
join.exe
Resource
win7-20240903-en
General
-
Target
join.exe
-
Size
200KB
-
MD5
ea95542a4a96525ec8eaf1f26d6770c5
-
SHA1
c97a8c81d5105d8ab822edb1b68a1053e9fd2ded
-
SHA256
4e718d1c539bace6976465321f3c86e79c652fbdb34e1997888cac3b0e58c661
-
SHA512
09f0be9c78ef88029a67012a59d570dc29f8f6f3d7f57c07cc9778e6e4d320b943ae9d39882bbb58916129e984bc0b005eef46b77142c1931925d73c1568721c
-
SSDEEP
3072:PTqPRdyeIKDWx85IOlKeJVos/8eRwXiUUAdV95I4Rp+LH1xrl3Ez8ub8Xr:PTqPRddIKCC0ef//uXltKc+LVsz9b8
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3536 set thread context of 4552 3536 join.exe 86 -
resource yara_rule behavioral2/memory/4552-2-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4552-4-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4552-5-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4552-6-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4552-8-0x0000000000400000-0x0000000000453000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language join.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language join.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3536 join.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3536 wrote to memory of 4552 3536 join.exe 86 PID 3536 wrote to memory of 4552 3536 join.exe 86 PID 3536 wrote to memory of 4552 3536 join.exe 86 PID 3536 wrote to memory of 4552 3536 join.exe 86 PID 3536 wrote to memory of 4552 3536 join.exe 86 PID 3536 wrote to memory of 4552 3536 join.exe 86 PID 3536 wrote to memory of 4552 3536 join.exe 86 PID 3536 wrote to memory of 4552 3536 join.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\join.exe"C:\Users\Admin\AppData\Local\Temp\join.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\join.exe/scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"2⤵
- System Location Discovery: System Language Discovery
PID:4552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3