Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
21s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
09/08/2021, 08:08
Static task
static1
Behavioral task
behavioral1
Sample
usfive_20210809-095748.exe
Resource
win7v20210408
General
-
Target
usfive_20210809-095748.exe
-
Size
511KB
-
MD5
4be0cbe1709ca5653bcc77a22511dd46
-
SHA1
c4492e5cfe705f705fb08bcb3dfe0b30af408d36
-
SHA256
244d3624209d79d74194422cb15ca209f957088aa1ee87a7cffadd0d6d3dfbc1
-
SHA512
b769a084d811065e8f14fced9b8f67d7b1b8b1d557381256f9321da694724cbe3bab9621899a8987ae2429f3a919f1f47c1336d031340d77056387ef0218a790
Malware Config
Extracted
raccoon
c58b0b3f1f90ad7552aaf8e84180b7580f397001
-
url4cnc
https://telete.in/h_electricryptors2
Signatures
-
Raccoon Stealer Payload 2 IoCs
resource yara_rule behavioral1/memory/360-61-0x0000000000220000-0x00000000002B3000-memory.dmp family_raccoon behavioral1/memory/360-62-0x0000000000400000-0x0000000002CB5000-memory.dmp family_raccoon -
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 1596 cmd.exe -
Loads dropped DLL 8 IoCs
pid Process 360 usfive_20210809-095748.exe 360 usfive_20210809-095748.exe 360 usfive_20210809-095748.exe 360 usfive_20210809-095748.exe 360 usfive_20210809-095748.exe 360 usfive_20210809-095748.exe 360 usfive_20210809-095748.exe 360 usfive_20210809-095748.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
pid Process 1568 timeout.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 usfive_20210809-095748.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 usfive_20210809-095748.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 360 wrote to memory of 1596 360 usfive_20210809-095748.exe 30 PID 360 wrote to memory of 1596 360 usfive_20210809-095748.exe 30 PID 360 wrote to memory of 1596 360 usfive_20210809-095748.exe 30 PID 360 wrote to memory of 1596 360 usfive_20210809-095748.exe 30 PID 1596 wrote to memory of 1568 1596 cmd.exe 32 PID 1596 wrote to memory of 1568 1596 cmd.exe 32 PID 1596 wrote to memory of 1568 1596 cmd.exe 32 PID 1596 wrote to memory of 1568 1596 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\usfive_20210809-095748.exe"C:\Users\Admin\AppData\Local\Temp\usfive_20210809-095748.exe"1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\usfive_20210809-095748.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1568
-
-