Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    104s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    11/06/2022, 16:34

General

  • Target

    FLP_1037850047.exe

  • Size

    379KB

  • MD5

    d32bc982566fbb8d81d3012779d3c320

  • SHA1

    74e5c60af59a50757abc29942c888fa43e854204

  • SHA256

    a59fbc4f9903ed18c989e87bc83073b463310ffe6c90a43c53400739719d0aae

  • SHA512

    de6afafb1412a652405072ba6f123383baa55e9287bbbef8a2e9c25edbfdebb6bf9e8aa1834caf386384096ce7eaa3c9dc03b7831f134ad8ccc4c98f066db699

Malware Config

Extracted

Family

oski

C2

duiy.xyz

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FLP_1037850047.exe
    "C:\Users\Admin\AppData\Local\Temp\FLP_1037850047.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Users\Admin\AppData\Local\Temp\FLP_1037850047.exe
      C:\Users\Admin\AppData\Local\Temp\FLP_1037850047.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 792
        3⤵
        • Program crash
        PID:1808

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1688-67-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1688-72-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1688-63-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1688-70-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1688-58-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1688-59-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1688-65-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1688-61-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1788-54-0x0000000000970000-0x00000000009D2000-memory.dmp

    Filesize

    392KB

  • memory/1788-55-0x00000000001F0000-0x00000000001FA000-memory.dmp

    Filesize

    40KB

  • memory/1788-57-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

    Filesize

    8KB

  • memory/1788-56-0x0000000000440000-0x0000000000462000-memory.dmp

    Filesize

    136KB