Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    93s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    13/07/2021, 17:54

General

  • Target

    can.exe

  • Size

    1.0MB

  • MD5

    5f70bb21955777e10ca01ead27d16b44

  • SHA1

    2f7d8adfb506718346d94177103d1d976380a9b4

  • SHA256

    84c1024292142c4d234701e830aedcbd865311693f0d8ac75596deee268c7db5

  • SHA512

    69f55a7902a4241c008c745a8f3bbc261bf0f9698f0b0b93aafb6ab8ce47b4e0eba47879e32404d6c3cdfab14cf55f60d5de4c34050bcb377f7f92a5a1ed16f4

Malware Config

Signatures

  • A310logger

    A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty Payload 3 IoCs
  • A310logger Executable 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\can.exe
    "C:\Users\Admin\AppData\Local\Temp\can.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\can.exe
      "C:\Users\Admin\AppData\Local\Temp\can.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:800
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\PASSWORDSNET4.exe
        3⤵
        • Executes dropped EXE
        • Checks processor information in registry
        PID:636
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\CREDITCARDNET4.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\CREDITCARDNET4.exe
        3⤵
        • Executes dropped EXE
        PID:1252

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/636-74-0x0000000000F20000-0x0000000000F21000-memory.dmp

    Filesize

    4KB

  • memory/800-69-0x0000000075591000-0x0000000075593000-memory.dmp

    Filesize

    8KB

  • memory/800-65-0x0000000000400000-0x000000000044A000-memory.dmp

    Filesize

    296KB

  • memory/800-76-0x00000000001B0000-0x00000000001B2000-memory.dmp

    Filesize

    8KB

  • memory/1252-81-0x0000000000E30000-0x0000000000E31000-memory.dmp

    Filesize

    4KB

  • memory/1268-59-0x0000000001070000-0x0000000001071000-memory.dmp

    Filesize

    4KB

  • memory/1268-63-0x0000000008020000-0x00000000080D5000-memory.dmp

    Filesize

    724KB

  • memory/1268-62-0x00000000003B0000-0x00000000003C0000-memory.dmp

    Filesize

    64KB

  • memory/1268-61-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

    Filesize

    4KB

  • memory/1268-64-0x0000000004FA0000-0x0000000005011000-memory.dmp

    Filesize

    452KB