Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
22/03/2025, 06:15
General
-
Target
b580ffe62d19e702d07e69a2f421a298.exe
-
Size
506KB
-
MD5
b580ffe62d19e702d07e69a2f421a298
-
SHA1
37592b4ea117b2c3d84ce09abae69d5f7c5d67f8
-
SHA256
4eb1993ce579eba3003f54035f826740b7a7eb0a2e2e3162e462f7d522735c2a
-
SHA512
5b2ae5c8a86f3e9b0f901f73cdceb4e2b993a615d25ad9300815b526f4ce25e8b6ec453925450a72486c00033aaf4f2092a78d2baee297e18718957d76611bc4
-
SSDEEP
6144:Aj2U/H3SACBa5FLFNSmjOvTe4ifmDCFPQLw5bIDN830wS7RHFABVP779VXi:NU/H3SACBiuSxmDCFPQkeSrSwV
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b580ffe62d19e702d07e69a2f421a298.exe"C:\Users\Admin\AppData\Local\Temp\b580ffe62d19e702d07e69a2f421a298.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5af69d667761ef87674be3d231a0ae0e6
SHA1a938c72cfd162d097391d3f53f0097fda5a9543f
SHA25655b2905b08f0715379db90291712363f16a80b3bfb33513012cb9ac7cbff4343
SHA51232a1994162bb873da35f99816b8740b61e8f9b5a3e22e4aa19704848b4760208f23989f174822669a3105719647c3db9145ae0a227cf41d967d50935da66c4ab
-
Filesize
44B
MD5fd2a14dc738c6017d8d26e68634f1878
SHA1d665042311d028ce5bdd74b3ca7dd052f31d5fc6
SHA2568b776f7d678f8894e2efcfad56c5b800fbd5c23f64fdb6f77975e7ab61c4d535
SHA5124286e839d609e9c63da73600d481f3fa6cd590f843ee07d7c3207c9b30d99940a0be4ed59192bbb7b92e096810fcc454de30ca4bf1b33e9c4c213312b89ad700
-
Filesize
8KB
-
Filesize
528KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
10.8MB