Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    128s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25/06/2022, 09:52

General

  • Target

    adddf3a8edacd49f26632d6e2db61c77c1e4f52a0f3ef042528f15eba7aab610.exe

  • Size

    502KB

  • MD5

    ab5be0d669ea17b096b0ab7f70c46d31

  • SHA1

    c0baca7a79c5acbe9b1a326539798599308ad94b

  • SHA256

    adddf3a8edacd49f26632d6e2db61c77c1e4f52a0f3ef042528f15eba7aab610

  • SHA512

    81362639d5e390577403e299df111017ca0246092234c3bdb40968b9cab0ff4ddfaab51c2ed75d253dfd718c682da216ff4d544b828b102b8f94f297e3e55d42

Score
10/10

Malware Config

Extracted

Family

oski

C2

serhuwadwtr.xyz

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • ReZer0 packer 1 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\adddf3a8edacd49f26632d6e2db61c77c1e4f52a0f3ef042528f15eba7aab610.exe
    "C:\Users\Admin\AppData\Local\Temp\adddf3a8edacd49f26632d6e2db61c77c1e4f52a0f3ef042528f15eba7aab610.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NpBKSSqrmfw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp687.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1660
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "{path}"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 756
        3⤵
        • Program crash
        PID:552

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp687.tmp

    Filesize

    1KB

    MD5

    2c6d8ea5f054dd66ab509b5f64f9c638

    SHA1

    561d1111af0786c21f72b69dde37dfd2f5dc49b3

    SHA256

    f269d395f28bd1b0e59fd798f31b9c0951d900e8101a3841673050a4cd8e89b3

    SHA512

    64941a9f1edaabf07a3c6cb5170ccf16ccf279e887d95450ac2a5d5e32ffa3effcb516c0097080280edbe46e546321e45f1281e7d80a228a7a52e4a55a5b88cc

  • memory/948-72-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/948-67-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/948-74-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/948-61-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/948-60-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/948-69-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/948-63-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/948-65-0x0000000000400000-0x0000000000434000-memory.dmp

    Filesize

    208KB

  • memory/948-73-0x0000000075B71000-0x0000000075B73000-memory.dmp

    Filesize

    8KB

  • memory/1996-54-0x00000000003D0000-0x0000000000458000-memory.dmp

    Filesize

    544KB

  • memory/1996-57-0x0000000002110000-0x000000000214C000-memory.dmp

    Filesize

    240KB

  • memory/1996-56-0x00000000003B0000-0x00000000003B8000-memory.dmp

    Filesize

    32KB

  • memory/1996-55-0x0000000000620000-0x0000000000660000-memory.dmp

    Filesize

    256KB