Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
33s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07/07/2020, 06:24 UTC
Static task
static1
Behavioral task
behavioral1
Sample
b1843967b94d29f088ec35143ad94e6e.exe
Resource
win7v200430
0 signatures
0 seconds
General
-
Target
b1843967b94d29f088ec35143ad94e6e.exe
-
Size
412KB
-
MD5
b1843967b94d29f088ec35143ad94e6e
-
SHA1
013aa99862c45afe518018a4ca5d8b230f94d0da
-
SHA256
12d8decff8e6285f7bf32161258817d35ebf684c9db5acb26aa79dd6c6e96960
-
SHA512
1c3a083b48cc8329cee05aa3ac24aadee65e21626f965623fee8fc7779ecdaaeb7096cb7744712a3fccb4a1c9e6231c7b61fd0541e4eb4131a33d1cf14f09ad5
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1400 b1843967b94d29f088ec35143ad94e6e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1400 b1843967b94d29f088ec35143ad94e6e.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1400 b1843967b94d29f088ec35143ad94e6e.exe -
Checks for installed software on the system 1 TTPs 30 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName b1843967b94d29f088ec35143ad94e6e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName b1843967b94d29f088ec35143ad94e6e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
Network
-
Remote address:8.8.8.8:53Requesttikkirikki.spaceIN AResponsetikkirikki.spaceIN A172.67.221.174tikkirikki.spaceIN A104.18.58.9tikkirikki.spaceIN A104.18.59.9
-
Remote address:172.67.221.174:443RequestGET /api.php HTTP/1.1
Host: tikkirikki.space
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=dc2e4099f9c7df2b9c0f543d618d7d6b01594103071; expires=Thu, 06-Aug-20 06:24:31 GMT; path=/; domain=.tikkirikki.space; HttpOnly; SameSite=Lax; Secure
Strict-Transport-Security: max-age=31536000; preload
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
cf-request-id: 03c98b999d0000fa20ac050200000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 5aef7ba29ef5fa20-AMS
-
Remote address:172.67.221.174:443RequestPOST /index.php HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accepts-Language: en-us,en;q=0.5
Content-Type: multipart/form-data; boundary=-------------------------8d8224f1e77ddd0
Host: tikkirikki.space
Content-Length: 502972
Expect: 100-continue
ResponseHTTP/1.1 100 Continue
-
Remote address:172.67.221.174:443ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=da687390bc5d514460f5ad7c5d513680e1594103078; expires=Thu, 06-Aug-20 06:24:38 GMT; path=/; domain=.tikkirikki.space; HttpOnly; SameSite=Lax; Secure
Strict-Transport-Security: max-age=31536000; preload
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
cf-request-id: 03c98bb5cf0000fa20ac133200000001
Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Server: cloudflare
CF-RAY: 5aef7bcfb9a3fa20-AMS
-
172.67.221.174:443https://tikkirikki.space/index.phptls, httpb1843967b94d29f088ec35143ad94e6e.exe519.9kB 14.7kB 373 196
HTTP Request
GET https://tikkirikki.space/api.phpHTTP Response
200HTTP Request
POST https://tikkirikki.space/index.phpHTTP Response
100HTTP Response
200