Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
19/06/2022, 11:47
Static task
static1
Behavioral task
behavioral1
Sample
1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe
Resource
win10v2004-20220414-en
General
-
Target
1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe
-
Size
323KB
-
MD5
d16246db1c3abce64bcb4ed32fd151fd
-
SHA1
7ba1ce14c3e2061bbb03022ca62a847b7aff3d4c
-
SHA256
1ede253254b0e22fe2178db8cf7ee8249083c98178156e8500c8a87e588158f9
-
SHA512
8a5d16b6dd3314a7923bac538c878122ec81f376d6deeaa5a06eb9f8bfa7b04a44c6b62cc8b221ccb890cc521e9f9596e4ec818da8ddb3e4baf0bf814caca5f4
Malware Config
Extracted
oski
castroseguranca.com.br
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Loads dropped DLL 2 IoCs
pid Process 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1668 set thread context of 1488 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1632 1488 WerFault.exe 28 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1488 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 28 PID 1668 wrote to memory of 1488 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 28 PID 1668 wrote to memory of 1488 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 28 PID 1668 wrote to memory of 1488 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 28 PID 1668 wrote to memory of 1488 1668 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 28 PID 1488 wrote to memory of 1632 1488 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 31 PID 1488 wrote to memory of 1632 1488 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 31 PID 1488 wrote to memory of 1632 1488 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 31 PID 1488 wrote to memory of 1632 1488 1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe"C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe"C:\Users\Admin\AppData\Local\Temp\1EDE253254B0E22FE2178DB8CF7EE8249083C98178156.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 9603⤵
- Program crash
PID:1632
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
Filesize
11KB
MD5fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c