Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2022, 20:43
Behavioral task
behavioral1
Sample
a64c16946bf03bfa2c52aba4dd0b55cc.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
a64c16946bf03bfa2c52aba4dd0b55cc.exe
Resource
win10v2004-20220722-en
General
-
Target
a64c16946bf03bfa2c52aba4dd0b55cc.exe
-
Size
136KB
-
MD5
a64c16946bf03bfa2c52aba4dd0b55cc
-
SHA1
7e048b042f7eee728bbac2720716bae32c9a236a
-
SHA256
07596ca20b3e197f4e03f9a88cd163ddeff5b6f521df937ffb1e0ef9746a78b6
-
SHA512
0289c12d8b8b4af7dca30cf862f252a14698a17dbf7d2b71eb941ec72b3eb5bc72a1c034eb4c19720ee04a943af7183758d08c9bb7abfdb224cee31b12d9921d
Malware Config
Signatures
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/544-135-0x0000000000BC0000-0x0000000000BDA000-memory.dmp family_stormkitty -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 icanhazip.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4412 set thread context of 544 4412 a64c16946bf03bfa2c52aba4dd0b55cc.exe 79 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 544 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4412 a64c16946bf03bfa2c52aba4dd0b55cc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4412 wrote to memory of 544 4412 a64c16946bf03bfa2c52aba4dd0b55cc.exe 79 PID 4412 wrote to memory of 544 4412 a64c16946bf03bfa2c52aba4dd0b55cc.exe 79 PID 4412 wrote to memory of 544 4412 a64c16946bf03bfa2c52aba4dd0b55cc.exe 79 PID 4412 wrote to memory of 544 4412 a64c16946bf03bfa2c52aba4dd0b55cc.exe 79 PID 4412 wrote to memory of 544 4412 a64c16946bf03bfa2c52aba4dd0b55cc.exe 79 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a64c16946bf03bfa2c52aba4dd0b55cc.exe"C:\Users\Admin\AppData\Local\Temp\a64c16946bf03bfa2c52aba4dd0b55cc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:544
-