Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    05/08/2022, 06:54

General

  • Target

    45061e4da841c2587d0890148705a142.exe

  • Size

    406KB

  • MD5

    45061e4da841c2587d0890148705a142

  • SHA1

    eb68218c1d70f3ba00f8190c8171ad1cfa2fb42a

  • SHA256

    6731f235ff78e22e5a0f1503542926bb707a95251b8cbd22c56fbd7fc5a8cbbf

  • SHA512

    01a561bbb8418364078e4751e69a5d61075220cfbaa7582a0b664ccc1fd45b6dd1accc4ef3dd2b2e6b0dc1a99d9e5f5605ee453eb6c1010c28a189109a51c294

Malware Config

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 4 IoCs
  • Executes dropped EXE 6 IoCs
  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
  • Loads dropped DLL 12 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45061e4da841c2587d0890148705a142.exe
    "C:\Users\Admin\AppData\Local\Temp\45061e4da841c2587d0890148705a142.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1800
    • \??\c:\users\admin\appdata\local\temp\45061e4da841c2587d0890148705a142.exe 
      c:\users\admin\appdata\local\temp\45061e4da841c2587d0890148705a142.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:540
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2044
    • C:\Users\Admin\AppData\Local\icsys.icn.exe
      C:\Users\Admin\AppData\Local\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1968
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Modifies Installed Components in the registry
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1464
        • \??\c:\windows\system\spoolsv.exe
          c:\windows\system\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1460
          • \??\c:\windows\system\svchost.exe
            c:\windows\system\svchost.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Modifies Installed Components in the registry
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:604
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1768
            • C:\Windows\SysWOW64\at.exe
              at 08:56 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
              6⤵
                PID:1736
              • C:\Windows\SysWOW64\at.exe
                at 08:57 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                6⤵
                  PID:1124
                • C:\Windows\SysWOW64\at.exe
                  at 08:58 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                  6⤵
                    PID:1996

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\45061e4da841c2587d0890148705a142.exe 

          Filesize

          132KB

          MD5

          bee47439c4960e2728594ece9ad95ba7

          SHA1

          43f4b6f607dec5bec2a33e2fb4148c38de832490

          SHA256

          8a1902d9c0dbe388b28ef5a9c8ec4c0f1802fc6ccd43471ea337dcb3d71c81d4

          SHA512

          ad84d419d61b63e36a6766ba90773b39270bf9c8e72373b52c1979097e73110f749fad0cfed5c4f233304ad0af4b6e753666911ff7db83475c16c38976c46382

        • C:\Users\Admin\AppData\Local\icsys.icn.exe

          Filesize

          274KB

          MD5

          4223968da579570e05813854a134397b

          SHA1

          07bdaa69105cae6467337d965eb968b6765fe28e

          SHA256

          85ce1f5747ce26adf8191236668b87796ed45b1e15a9b87fa8a2f3c80b9b65fc

          SHA512

          c62411e35db1940412bf5d8132c1a9a4346ec179b23ec57945be7ea64c5640850cfff94b122ca980293653b270a0c968c48e0b27af0af0bd5bfe177ed72e6beb

        • C:\Users\Admin\AppData\Roaming\mrsys.exe

          Filesize

          274KB

          MD5

          03da701acf20d1fcb8f5e203e3d2d04c

          SHA1

          76f6f443b4648e92cc84ed5131a73d3b648ffd71

          SHA256

          f44cfe6eac92010bcc8a67c5416d481a5875df9e6986783691def9a42b840aa2

          SHA512

          f2e34dbe0a70df9c290393b377fbe8d725504fc48e5505124417e0c4018b843a23b408fbc9e422e8ca50665060d585b99a40addc8a3b8188011d02ebb8cbc235

        • C:\Windows\system\explorer.exe

          Filesize

          274KB

          MD5

          ae6b5b5628edb90fdd1e804a14184270

          SHA1

          75f4420f9e5a283eb69fc95a91ff89356d846ad2

          SHA256

          f402e4248a96ff78878697c6da3bc501711fc704dc289ae1d90edacfbd679370

          SHA512

          ecd8a2112a8d41f8b1e4539eec671ef024c39ed82d5f414fa82c0dde0b3db2b3e51c47a2cae545aae9f36c99019f02c2e22f084d47772536e80bec3ab2929efc

        • C:\Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          04aa4b493a4a3aeb7035ca6561e5a323

          SHA1

          33dec371c78b1004835bd8bdc9023278f825a5cb

          SHA256

          d814c25781a7881d0d6f7a9774ad18ddd0142813c266ac6087c74cd8f16a90ee

          SHA512

          90a9e5aca6b7d57c26c7cffb1afbf6483ecdec02e38f9b79aa1ea684347bbaeab9ccb5f12d2a94a37bb46c1185e9059e41db5fe2f70968b7b35247410e53a563

        • C:\Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          04aa4b493a4a3aeb7035ca6561e5a323

          SHA1

          33dec371c78b1004835bd8bdc9023278f825a5cb

          SHA256

          d814c25781a7881d0d6f7a9774ad18ddd0142813c266ac6087c74cd8f16a90ee

          SHA512

          90a9e5aca6b7d57c26c7cffb1afbf6483ecdec02e38f9b79aa1ea684347bbaeab9ccb5f12d2a94a37bb46c1185e9059e41db5fe2f70968b7b35247410e53a563

        • C:\Windows\system\svchost.exe

          Filesize

          274KB

          MD5

          9beed83577e8393855467a30bcce8f06

          SHA1

          8f8f686ceb5840b899abec9da98745194fde93ca

          SHA256

          c5badccc7c773629253fa0edb89ac175f3deb89d0cdc4eb0c9a34eebe4f62dad

          SHA512

          3fa07af29a944733f350b3e45fbf8d56ae0c7dd3734a5588dfa84bdc3a5340bb8d96bdaf8aebd9cec5d14a7345faf44fb43133efc7b84ceb6701723ad85ec459

        • \??\c:\users\admin\appdata\local\icsys.icn.exe

          Filesize

          274KB

          MD5

          4223968da579570e05813854a134397b

          SHA1

          07bdaa69105cae6467337d965eb968b6765fe28e

          SHA256

          85ce1f5747ce26adf8191236668b87796ed45b1e15a9b87fa8a2f3c80b9b65fc

          SHA512

          c62411e35db1940412bf5d8132c1a9a4346ec179b23ec57945be7ea64c5640850cfff94b122ca980293653b270a0c968c48e0b27af0af0bd5bfe177ed72e6beb

        • \??\c:\windows\system\explorer.exe

          Filesize

          274KB

          MD5

          ae6b5b5628edb90fdd1e804a14184270

          SHA1

          75f4420f9e5a283eb69fc95a91ff89356d846ad2

          SHA256

          f402e4248a96ff78878697c6da3bc501711fc704dc289ae1d90edacfbd679370

          SHA512

          ecd8a2112a8d41f8b1e4539eec671ef024c39ed82d5f414fa82c0dde0b3db2b3e51c47a2cae545aae9f36c99019f02c2e22f084d47772536e80bec3ab2929efc

        • \??\c:\windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          04aa4b493a4a3aeb7035ca6561e5a323

          SHA1

          33dec371c78b1004835bd8bdc9023278f825a5cb

          SHA256

          d814c25781a7881d0d6f7a9774ad18ddd0142813c266ac6087c74cd8f16a90ee

          SHA512

          90a9e5aca6b7d57c26c7cffb1afbf6483ecdec02e38f9b79aa1ea684347bbaeab9ccb5f12d2a94a37bb46c1185e9059e41db5fe2f70968b7b35247410e53a563

        • \??\c:\windows\system\svchost.exe

          Filesize

          274KB

          MD5

          9beed83577e8393855467a30bcce8f06

          SHA1

          8f8f686ceb5840b899abec9da98745194fde93ca

          SHA256

          c5badccc7c773629253fa0edb89ac175f3deb89d0cdc4eb0c9a34eebe4f62dad

          SHA512

          3fa07af29a944733f350b3e45fbf8d56ae0c7dd3734a5588dfa84bdc3a5340bb8d96bdaf8aebd9cec5d14a7345faf44fb43133efc7b84ceb6701723ad85ec459

        • \Users\Admin\AppData\Local\Temp\45061e4da841c2587d0890148705a142.exe 

          Filesize

          132KB

          MD5

          bee47439c4960e2728594ece9ad95ba7

          SHA1

          43f4b6f607dec5bec2a33e2fb4148c38de832490

          SHA256

          8a1902d9c0dbe388b28ef5a9c8ec4c0f1802fc6ccd43471ea337dcb3d71c81d4

          SHA512

          ad84d419d61b63e36a6766ba90773b39270bf9c8e72373b52c1979097e73110f749fad0cfed5c4f233304ad0af4b6e753666911ff7db83475c16c38976c46382

        • \Users\Admin\AppData\Local\Temp\45061e4da841c2587d0890148705a142.exe 

          Filesize

          132KB

          MD5

          bee47439c4960e2728594ece9ad95ba7

          SHA1

          43f4b6f607dec5bec2a33e2fb4148c38de832490

          SHA256

          8a1902d9c0dbe388b28ef5a9c8ec4c0f1802fc6ccd43471ea337dcb3d71c81d4

          SHA512

          ad84d419d61b63e36a6766ba90773b39270bf9c8e72373b52c1979097e73110f749fad0cfed5c4f233304ad0af4b6e753666911ff7db83475c16c38976c46382

        • \Users\Admin\AppData\Local\icsys.icn.exe

          Filesize

          274KB

          MD5

          4223968da579570e05813854a134397b

          SHA1

          07bdaa69105cae6467337d965eb968b6765fe28e

          SHA256

          85ce1f5747ce26adf8191236668b87796ed45b1e15a9b87fa8a2f3c80b9b65fc

          SHA512

          c62411e35db1940412bf5d8132c1a9a4346ec179b23ec57945be7ea64c5640850cfff94b122ca980293653b270a0c968c48e0b27af0af0bd5bfe177ed72e6beb

        • \Users\Admin\AppData\Local\icsys.icn.exe

          Filesize

          274KB

          MD5

          4223968da579570e05813854a134397b

          SHA1

          07bdaa69105cae6467337d965eb968b6765fe28e

          SHA256

          85ce1f5747ce26adf8191236668b87796ed45b1e15a9b87fa8a2f3c80b9b65fc

          SHA512

          c62411e35db1940412bf5d8132c1a9a4346ec179b23ec57945be7ea64c5640850cfff94b122ca980293653b270a0c968c48e0b27af0af0bd5bfe177ed72e6beb

        • \Windows\system\explorer.exe

          Filesize

          274KB

          MD5

          ae6b5b5628edb90fdd1e804a14184270

          SHA1

          75f4420f9e5a283eb69fc95a91ff89356d846ad2

          SHA256

          f402e4248a96ff78878697c6da3bc501711fc704dc289ae1d90edacfbd679370

          SHA512

          ecd8a2112a8d41f8b1e4539eec671ef024c39ed82d5f414fa82c0dde0b3db2b3e51c47a2cae545aae9f36c99019f02c2e22f084d47772536e80bec3ab2929efc

        • \Windows\system\explorer.exe

          Filesize

          274KB

          MD5

          ae6b5b5628edb90fdd1e804a14184270

          SHA1

          75f4420f9e5a283eb69fc95a91ff89356d846ad2

          SHA256

          f402e4248a96ff78878697c6da3bc501711fc704dc289ae1d90edacfbd679370

          SHA512

          ecd8a2112a8d41f8b1e4539eec671ef024c39ed82d5f414fa82c0dde0b3db2b3e51c47a2cae545aae9f36c99019f02c2e22f084d47772536e80bec3ab2929efc

        • \Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          04aa4b493a4a3aeb7035ca6561e5a323

          SHA1

          33dec371c78b1004835bd8bdc9023278f825a5cb

          SHA256

          d814c25781a7881d0d6f7a9774ad18ddd0142813c266ac6087c74cd8f16a90ee

          SHA512

          90a9e5aca6b7d57c26c7cffb1afbf6483ecdec02e38f9b79aa1ea684347bbaeab9ccb5f12d2a94a37bb46c1185e9059e41db5fe2f70968b7b35247410e53a563

        • \Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          04aa4b493a4a3aeb7035ca6561e5a323

          SHA1

          33dec371c78b1004835bd8bdc9023278f825a5cb

          SHA256

          d814c25781a7881d0d6f7a9774ad18ddd0142813c266ac6087c74cd8f16a90ee

          SHA512

          90a9e5aca6b7d57c26c7cffb1afbf6483ecdec02e38f9b79aa1ea684347bbaeab9ccb5f12d2a94a37bb46c1185e9059e41db5fe2f70968b7b35247410e53a563

        • \Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          04aa4b493a4a3aeb7035ca6561e5a323

          SHA1

          33dec371c78b1004835bd8bdc9023278f825a5cb

          SHA256

          d814c25781a7881d0d6f7a9774ad18ddd0142813c266ac6087c74cd8f16a90ee

          SHA512

          90a9e5aca6b7d57c26c7cffb1afbf6483ecdec02e38f9b79aa1ea684347bbaeab9ccb5f12d2a94a37bb46c1185e9059e41db5fe2f70968b7b35247410e53a563

        • \Windows\system\spoolsv.exe

          Filesize

          274KB

          MD5

          04aa4b493a4a3aeb7035ca6561e5a323

          SHA1

          33dec371c78b1004835bd8bdc9023278f825a5cb

          SHA256

          d814c25781a7881d0d6f7a9774ad18ddd0142813c266ac6087c74cd8f16a90ee

          SHA512

          90a9e5aca6b7d57c26c7cffb1afbf6483ecdec02e38f9b79aa1ea684347bbaeab9ccb5f12d2a94a37bb46c1185e9059e41db5fe2f70968b7b35247410e53a563

        • \Windows\system\svchost.exe

          Filesize

          274KB

          MD5

          9beed83577e8393855467a30bcce8f06

          SHA1

          8f8f686ceb5840b899abec9da98745194fde93ca

          SHA256

          c5badccc7c773629253fa0edb89ac175f3deb89d0cdc4eb0c9a34eebe4f62dad

          SHA512

          3fa07af29a944733f350b3e45fbf8d56ae0c7dd3734a5588dfa84bdc3a5340bb8d96bdaf8aebd9cec5d14a7345faf44fb43133efc7b84ceb6701723ad85ec459

        • \Windows\system\svchost.exe

          Filesize

          274KB

          MD5

          9beed83577e8393855467a30bcce8f06

          SHA1

          8f8f686ceb5840b899abec9da98745194fde93ca

          SHA256

          c5badccc7c773629253fa0edb89ac175f3deb89d0cdc4eb0c9a34eebe4f62dad

          SHA512

          3fa07af29a944733f350b3e45fbf8d56ae0c7dd3734a5588dfa84bdc3a5340bb8d96bdaf8aebd9cec5d14a7345faf44fb43133efc7b84ceb6701723ad85ec459

        • memory/604-129-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1460-108-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1460-123-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1464-134-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1464-107-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1768-122-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1800-125-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1800-57-0x0000000076291000-0x0000000076293000-memory.dmp

          Filesize

          8KB

        • memory/1800-102-0x0000000002520000-0x000000000255E000-memory.dmp

          Filesize

          248KB

        • memory/1800-101-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1968-103-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1968-124-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2044-70-0x0000000000090000-0x00000000000AA000-memory.dmp

          Filesize

          104KB

        • memory/2044-67-0x0000000000090000-0x00000000000AA000-memory.dmp

          Filesize

          104KB

        • memory/2044-72-0x0000000000090000-0x00000000000AA000-memory.dmp

          Filesize

          104KB

        • memory/2044-65-0x0000000000090000-0x00000000000AA000-memory.dmp

          Filesize

          104KB