Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22/03/2025, 06:15
General
-
Target
b580ffe62d19e702d07e69a2f421a298.exe
-
Size
506KB
-
MD5
b580ffe62d19e702d07e69a2f421a298
-
SHA1
37592b4ea117b2c3d84ce09abae69d5f7c5d67f8
-
SHA256
4eb1993ce579eba3003f54035f826740b7a7eb0a2e2e3162e462f7d522735c2a
-
SHA512
5b2ae5c8a86f3e9b0f901f73cdceb4e2b993a615d25ad9300815b526f4ce25e8b6ec453925450a72486c00033aaf4f2092a78d2baee297e18718957d76611bc4
-
SSDEEP
6144:Aj2U/H3SACBa5FLFNSmjOvTe4ifmDCFPQLw5bIDN830wS7RHFABVP779VXi:NU/H3SACBiuSxmDCFPQkeSrSwV
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b580ffe62d19e702d07e69a2f421a298.exe"C:\Users\Admin\AppData\Local\Temp\b580ffe62d19e702d07e69a2f421a298.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
528KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB