Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2022, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
PO 7500093232.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
PO 7500093232.exe
Resource
win10v2004-20220721-en
General
-
Target
PO 7500093232.exe
-
Size
482KB
-
MD5
832efb6bf9f508ebb2c41257fadcc300
-
SHA1
1e8667e1561c3411f42f98c494dcc99be36d6d6a
-
SHA256
f9bc0d5860d6135dab48b897e55465d88ebd0ca9b73ebdbaf83957d6e3bee26f
-
SHA512
f866c97b78b006891b34b5afa8f0d3e3a8bf0e7033ab8970e142427e2611f07127fb3661bec26d43e0f68aa9e19aa8932adc2fb296cf1cdfdd85dd2b72eb30ea
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload 1 IoCs
resource yara_rule behavioral2/memory/3984-143-0x0000000000550000-0x000000000056A000-memory.dmp family_stormkitty -
Downloads MZ/PE file
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aLFDxEdS.lnk PO 7500093232.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 icanhazip.com -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4636 set thread context of 4492 4636 PO 7500093232.exe 82 PID 4492 set thread context of 3984 4492 PO 7500093232.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 AppLaunch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4636 PO 7500093232.exe Token: SeDebugPrivilege 3984 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4492 PO 7500093232.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4636 wrote to memory of 4492 4636 PO 7500093232.exe 82 PID 4636 wrote to memory of 4492 4636 PO 7500093232.exe 82 PID 4636 wrote to memory of 4492 4636 PO 7500093232.exe 82 PID 4636 wrote to memory of 4492 4636 PO 7500093232.exe 82 PID 4636 wrote to memory of 4492 4636 PO 7500093232.exe 82 PID 4636 wrote to memory of 4492 4636 PO 7500093232.exe 82 PID 4636 wrote to memory of 4492 4636 PO 7500093232.exe 82 PID 4636 wrote to memory of 4492 4636 PO 7500093232.exe 82 PID 4492 wrote to memory of 3984 4492 PO 7500093232.exe 84 PID 4492 wrote to memory of 3984 4492 PO 7500093232.exe 84 PID 4492 wrote to memory of 3984 4492 PO 7500093232.exe 84 PID 4492 wrote to memory of 3984 4492 PO 7500093232.exe 84 PID 4492 wrote to memory of 3984 4492 PO 7500093232.exe 84 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 7500093232.exe"C:\Users\Admin\AppData\Local\Temp\PO 7500093232.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\PO 7500093232.exe"C:\Users\Admin\AppData\Local\Temp\PO 7500093232.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe3⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3984
-
-