Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18/03/2025, 08:42
General
-
Target
d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca.exe
-
Size
396KB
-
MD5
ec221c0b18e1e431bda3c714a45db18f
-
SHA1
96b694c61f696110bdf5441ca63a0456382505ec
-
SHA256
d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca
-
SHA512
f4909e34dfcc2a105e39b544f6d98925b57baef30979bc99cb308efda3c537ec460af0fa6271ca97cfd146754524e152300ba2fe3dd52b40b1269f13d4d5bf0c
-
SSDEEP
6144:7vbuWQu/cuaS2l8iE0B55FrJJJekPdb5J22u:7vqWQub2lrE0B55FpekPdb/22u
Malware Config
Signatures
-
Blackmoon family
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca.exe"C:\Users\Admin\AppData\Local\Temp\d037678d81708397aa4e82d68d810503b8b04223a1470eea406b7b7b73aca3ca.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Syslemzxnyi.exe"C:\Users\Admin\AppData\Local\Temp\Syslemzxnyi.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD583142242e97b8953c386f988aa694e4a
SHA1833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10
-
Filesize
396KB
MD5839d60ac2ddfbe4359d66138e569e641
SHA1cce83cab7e712b96ab4541d31a40ee2e5e4c3200
SHA2561a6d6aba1c7c3baf07693e27253cc887e131edc60bcb6e3b53273c2aa3fc24bf
SHA512bdd8c6adb0414950283be1bb14ce862cf3f3b34c9769b57f676c12640f517599de05ec74875ce45b316a67fc212c719a2e1c573ab0b4c9f3c10c8f8e8cadce99
-
Filesize
183KB
MD5109cab5505f5e065b63d01361467a83b
SHA14ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc
-
Filesize
102B
MD540c9ef1275e833f97137c1cec6acd13a
SHA12fa374bd947cf7ef12c957f2507a28b48ed9c199
SHA25641608f820d8a4c64439ceecfcd17aa8b54b69b790e75f8994c89981aaf597c81
SHA51283f18b69516aca15d5e8b7d8db883e142b3335c896780a3c085c75382fe964ed64d66afaf422d6eff5a34241bfc4a1dddd54e5efa5eb65fdc83d718a9909116b